Description

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-12T06:16:28.537Z",
  "pubdate": "2026-09-12T06:16:28.537Z",
  "executiveSummary": "The Product XML Feed Manager for WooCommerce plugin for WordPress, in versions prior to 3.1.1, contains an Improper Access Control vulnerability that facilitates unauthorized product deletion.\nThe vulnerability originates from the plugin's failure to validate object method calls invoked via shortcodes and its lack of capability checks regarding product manipulation.\nAn authenticated attacker with contributor-level privileges can trigger the deletion of arbitrary products by leveraging a maliciously crafted post containing the specific vulnerable shortcode.\nThis flaw represents a significant security risk, as it permits low-privileged users to perform destructive actions against the store's inventory management system, potentially leading to unauthorized data loss and disruption of business operations.\nExploitation requires the attacker to have at least contributor-level access and the ability to draft or preview posts within the WordPress environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of a shortcode handler within the Product XML Feed Manager for WooCommerce. The plugin fails to implement an allowlist for the methods that can be invoked through its shortcode interface.\nWhen a WordPress post containing the shortcode is processed—specifically during the preview phase—the plugin executes backend methods associated with product objects without performing necessary validation of the intended action or the legitimacy of the caller.\nThe vulnerability is characterized by a lack of capability checks. WordPress roles, such as 'Contributor,' are not intended to possess the administrative or shop-manager capabilities required to modify or delete WooCommerce product entities. By failing to verify current_user_can() permissions before executing the product manipulation logic, the plugin allows an authenticated user to bypass WordPress core permission models.\nThe attack flow is executed as follows: 1) An attacker with contributor access creates a new post or page within the WordPress dashboard. 2) The attacker embeds the vulnerable shortcode into the post body, configured with parameters that target the intended product identifier and the destructive method. 3) The attacker triggers a preview of the post. 4) The server-side rendering of the preview initiates the shortcode execution flow, invoking the unvalidated product deletion function. 5) The WooCommerce product corresponding to the provided ID is permanently removed from the database.\nThis vulnerability is restricted to authenticated users, but the privilege escalation resulting from the improper access control allows a contributor to perform actions reserved for administrators or shop managers. The impact is a total loss of product data for the affected store, as the deletion operation typically bypasses standard verification steps."
}