CVE-2026-118093: WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability

Q: Who is exposed to this issue?

Sites using the WordPress Product Feed Manager plugin (best-woocommerce-feed) are affected if they run a version through 7.14.1. The affected version range begins at an unspecified earlier version.

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The supplied CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What impact does the available severity data indicate?

The CVSS vector indicates an integrity impact only; confidentiality and availability impacts are listed as none. The issue is rated medium severity with a CVSS score of 5.3.

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Product Feed Manager (best-woocommerce-feed) to a version that resolves this vulnerability.
Fixed in 7.14.2

Event History

Oct 29, 2026

CVE Published

via MITRE·12:58 PM

Data Sourced

via MITRE·12:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using the WordPress Product Feed Manager plugin (best-woocommerce-feed) are affected if they run a version through 7.14.1. The affected version range begins at an unspecified earlier version.

Does exploitation require an authenticated WordPress account or user interaction?

No. The supplied CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

What impact does the available severity data indicate?

The CVSS vector indicates an integrity impact only; confidentiality and availability impacts are listed as none. The issue is rated medium severity with a CVSS score of 5.3.

CVE-2026-118093: WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require an authenticated WordPress account or user interaction?

What impact does the available severity data indicate?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require an authenticated WordPress account or user interaction?

What impact does the available severity data indicate?