CVE-2026-87968: Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites using the affected WordPress plugin version before 5.3.2 are exposed. The vulnerable AJAX action is available to unauthenticated users, so exposure does not depend on an attacker having a WordPress account.
What does an attacker need to do to exploit this?
An attacker only needs to access the affected site's vulnerable AJAX action as a visitor. No nonce or capability check is performed for the store-registration action.
What is the impact of successful exploitation?
An attacker can force the store to re-register with the feed service and overwrite the plugin's stored shop secret.
What should be done if the site cannot be updated immediately?
The provided information does not specify a workaround. Restricting unauthenticated access to the affected AJAX action may reduce exposure, but the data does not identify a specific action name or supported mitigation.