CVE-2026-87919: Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Product XML Feed Manager for WooCommerce (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with contributor-level access can exploit it. The issue enables that user to delete WooCommerce products beyond those they would normally be authorized to manage.
What action triggers the deletion?
The attacker needs to place the affected product shortcode in a post and preview that post. The shortcode can be used to call an object method that deletes an arbitrary targeted WooCommerce product.
Are installations running version 3.1.1 affected?
No. The issue affects Product XML Feed Manager for WooCommerce versions before 3.1.1.