{
 "id": "WPSEC-2026-3119",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3119/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3119/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3119/index.md",
 "title": "Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.8 - Authenticated (Contributor+) PHP Object Injection via Feed Meta",
 "description": "The Product Feed PRO for WooCommerce by AdTribes plugin for WordPress is vulnerable to PHP Object Injection via feed meta in all versions up to, and including, 13.5.8. This is due to two flaws. The adt_product_feed post type was registered with the default 'post' capabilities, so any user with edit_posts can create a draft feed and set its adt_* custom fields through XML-RPC. The usage-tracking check-in also passes the stored adt_attributes meta through maybe_unserialize() a second time, without restricting classes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object, which is unserialized when the weekly usage check-in runs on sites where usage tracking is enabled. No known POP chain is present in the vulnerable software. If a POP chain is present through an additional plugin or theme on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "woo-product-feed-pro",
  "name": "Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce",
  "full_name": "Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-product-feed-pro/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-product-feed-pro/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-product-feed-pro"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "13.3.9",
    "from_inclusive": true,
    "to": "13.5.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 13.3.9 before 13.5.9"
  ]
 },
 "introduced_in": "13.3.9",
 "fixed_in": "13.5.9",
 "remediation": "Update to 13.5.9 or later.",
 "fix_released": "2026-11-13T00:25:00+00:00",
 "published": "2026-11-14T00:41:58+00:00",
 "updated": "2026-11-13T15:54:20.743400+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3119/",
  "https://plugins.svn.wordpress.org/woo-product-feed-pro/tags/13.5.9/",
  "https://wordpress.org/plugins/woo-product-feed-pro/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-product-feed-pro",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}