Description

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-08T10:17:14.337Z",
  "pubdate": "2026-09-08T10:17:14.337Z",
  "executiveSummary": "The EDD Product Catalog Feed by PixelYourSite plugin is susceptible to an unauthorized data modification vulnerability.\nThe issue stems from a missing capability check within the wpeddpcf_delete_feed function, allowing authenticated users with minimal privileges (subscriber-level and above) to execute unauthorized deletion operations.\nBy manipulating the target parameters, an attacker can delete arbitrary option values stored in the WordPress database.\nThis vulnerability leads to a Denial of Service (DoS) condition, as an attacker can remove critical site configuration options, resulting in site-wide functional failures or application crashes.\nThe vulnerability affects all versions of the plugin up to and including 1.0.2.\nExploitation requires the attacker to possess an active subscriber account on the target WordPress installation, but does not require administrative privileges.",
  "technicalDetails": "The vulnerability is localized within the wpeddpcf_delete_feed function, which is intended to handle the deletion of feed configurations but lacks the necessary security controls to verify the requester's authorization level.\nThe root cause is a failure to implement the current_user_can() function or equivalent access control checks prior to processing the deletion request. In the WordPress architecture, this function is accessible to any authenticated user due to improper registration of the underlying AJAX or request handler.\nAn attacker can exploit this by crafting a request that invokes the wpeddpcf_delete_feed function while providing parameters intended for the deletion of WordPress options stored in the wp_options table. Since the function lacks input validation and capability verification, the application treats the malicious request as a legitimate command.\nThe attack flow proceeds as follows: First, the authenticated attacker sends a crafted POST request targeting the vulnerable endpoint associated with wpeddpcf_delete_feed. Second, the server-side code receives the payload without verifying if the user holds an administrative role (e.g., 'manage_options'). Third, the function executes a database operation that deletes a record from the options table. By targeting a key system option required for the site's operation—such as the site URL, theme settings, or plugin configuration—the attacker induces a state where the site cannot load correctly, effectively performing a Denial of Service.\nThe impact is significant because the ability to modify or delete arbitrary options allows for more than just simple deletion; it can potentially lead to complete site takeover or permanent data corruption if critical database entries are removed. Because the vulnerability resides in the core logic of the plugin's feed management, it remains exposed until the developer implements strict capability checks to ensure that only authorized administrators can interact with sensitive plugin administrative functions.\nThe vulnerability affects all plugin versions up to and including 1.0.2. There is no automated sanitization or restriction in place, meaning any registered user on the site can trigger this function repeatedly until the desired damage to the application's configuration is achieved."
}