CVE-2026-3499
CSRF Vulnerability in Product Feed PRO for WooCommerce Plugin
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adtribes | product_feed_pro_for_woocommerce | From 13.4.6 (inc) to 13.5.2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves missing or incorrect nonce validation in specific AJAX functions of the Product Feed PRO for WooCommerce plugin. Detection would typically involve checking for unauthorized or forged AJAX requests targeting the vulnerable functions: ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed.
Since the vulnerability requires an attacker to trick a site administrator into performing an action, monitoring for unusual or unexpected AJAX requests in web server logs or using a web application firewall (WAF) to detect suspicious POST requests to these AJAX endpoints could help.
No specific commands or detection scripts are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Product Feed PRO for WooCommerce plugin to a version later than 13.5.2.1 where the nonce validation issue is fixed.
If an update is not immediately possible, restricting access to the vulnerable AJAX endpoints by implementing additional authentication or firewall rules can reduce risk.
Additionally, educating site administrators to avoid clicking on suspicious links can help prevent exploitation since the attack requires user interaction.
Can you explain this vulnerability to me?
This vulnerability affects the Product Feed PRO for WooCommerce plugin for WordPress, specifically versions 13.4.6 through 13.5.2.1. It is a Cross-Site Request Forgery (CSRF) issue caused by missing or incorrect nonce validation on several AJAX functions.
Because of this, an unauthenticated attacker can trick a site administrator into performing certain actions by sending forged requests. These actions include triggering feed migration, clearing custom-attribute transient caches, rewriting feed file URLs to lowercase, toggling legacy filter and rule settings, and deleting duplicated feed posts.
How can this vulnerability impact me? :
The vulnerability can have a severe impact as it allows attackers to perform high-privilege actions without authentication by tricking administrators into clicking malicious links.
- Triggering feed migration unexpectedly, which could disrupt normal feed operations.
- Clearing custom-attribute transient caches, potentially causing data loss or inconsistent behavior.
- Rewriting feed file URLs to lowercase, which might break URL references or cause errors.
- Toggling legacy filter and rule settings, possibly changing how product feeds are processed.
- Deleting duplicated feed posts, leading to loss of feed data.
Overall, the vulnerability can compromise the integrity, availability, and reliability of the product feed system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to perform actions such as triggering feed migration, clearing caches, rewriting URLs, toggling settings, and deleting posts by tricking a site administrator into clicking a link. This can lead to unauthorized changes and potential data integrity issues.
Such unauthorized actions could impact compliance with standards like GDPR and HIPAA by compromising data integrity, availability, and potentially confidentiality if sensitive data is affected. However, the provided information does not explicitly detail the direct compliance impact.