CVE-2026-116107
Received Received - Intake

Missing Authorization in Datafeedr Product Sets WordPress Plugin

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116107
EUVD
EUVD-2026-109599

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Datafeedr Product Sets Plugin for WordPress up to version 1.3.24. It involves a missing authorization check in the function dfrps_ajax_delete_saved_search within the AJAX handlers. An attacker can exploit this remotely to perform unauthorized actions. The issue has been publicly disclosed and a patch is available in version 1.3.25.

Detection Guidance

Check WordPress plugin versions using the WordPress admin panel or run: wp plugin list --name=datafeedr-product-sets. Verify if the installed version is below 1.3.25.

Impact Analysis

An attacker could exploit this to delete saved searches or perform other unauthorized actions in the plugin. This could disrupt product set management or lead to data loss if exploited. The low CVSS scores suggest limited impact but still require updating to avoid potential risks.

Compliance Impact

The vulnerability involves missing authorization in the Datafeedr Product Sets Plugin, potentially allowing unauthorized access or manipulation of product data. This could lead to unauthorized data exposure or modification, which may violate GDPR principles of data integrity and confidentiality if personal data is involved. For HIPAA, if the plugin handles protected health information, the lack of proper access controls could result in unauthorized access, compromising compliance with HIPAA's security requirements.

Mitigation Strategies

Upgrade the Datafeedr Product Sets Plugin to version 1.3.25 or higher immediately. Ensure the Datafeedr API plugin is updated to version 1.4.3 or higher as required for security fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart