CVE-2026-87968

Deferred Deferred - Pending Action

Authentication Bypass in Product Feed for WooCommerce

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-87968

EUVD

EUVD-2026-100857

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Product	Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WordPress plugin 'Product Feed for Google Shopping' versions before 5.3.2. It allows unauthenticated users to force a store to re-register and overwrite the plugin's stored shop secret due to missing nonce or capability checks on an AJAX action. This enables any visitor to manipulate the store's registration.

Detection Guidance

Check if the WordPress plugin 'Product Feed for Google Shopping' is installed and if its version is prior to 5.3.2. Look for unauthorized changes in the plugin's stored shop secret or registration details.

Impact Analysis

An attacker could exploit this to overwrite the plugin's shop secret, potentially leading to unauthorized access or data manipulation. This could disrupt the store's product feed services and compromise its functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves unauthorized manipulation of a WordPress plugin's registration process rather than data breaches or unauthorized access to sensitive information. However, if exploited, it could lead to unauthorized changes in product feeds which may indirectly impact data integrity or availability.

Mitigation Strategies

Update the 'Product Feed for Google Shopping' plugin to version 5.3.2 or later immediately. Review the plugin's settings for any unauthorized changes and revoke any suspicious registrations.

Hi! I’m here to help you understand CVE-2026-87968. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70