CVE-2026-87919 — Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode

CVE-2026-87919

Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode PUBLISHED

Description (CNA)

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.

Affected (CNA)

Vendor / product	Versions
Unknown / Product XML Feed Manager for WooCommerce	affected 0 before 3.1.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2e2f48d3-9106-4357-beec-4dbea02223dc/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.