CVE-2026-116107: Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Datafeedr Product Sets Pluginto a version that resolves this vulnerability.Fixed in 1.3.25
Event History
Frequently Asked Questions
Which installations are affected?
Datafeedr Product Sets Plugin for WordPress versions up to and including 1.3.24 are affected. Version 1.3.25 resolves the issue.
What access does an attacker need?
The issue is remotely reachable and has low attack complexity, but the severity vector indicates that low-level privileges are required. No user interaction is required.
What could exploitation allow?
The vulnerable dfrps_ajax_delete_saved_search AJAX handler has missing authorization. Successful exploitation can affect integrity and availability at a low impact level.
How urgent is remediation?
Upgrade the affected plugin component to version 1.3.25. Public exploit availability is reported, increasing the likelihood of exploitation.