CVE-2026-15258 — Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

CVE-2026-15258

Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter PUBLISHED

Description (CNA)

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

Affected (CNA)

Vendor / product	Versions
Unknown / Product Feed Manager For WooCommerce	affected 0 before 7.6.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9e20442b-047b-46fe-be72-89c637deb6bc/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.