CVE-2026-9331

Deferred Deferred - Pending Action

Unauthenticated Option Deletion in EDD Product Catalog Feed Plugin

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Wordfence

Description

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-9331

Affected Vendors & Products

Vendor	Product	Version / Range
pixelyoursite	edd_product_catalog_feed	to 1.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The EDD Product Catalog Feed plugin for WordPress has a vulnerability due to a missing capability check in the wpeddpcf_delete_feed function. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary option values on the site. This can cause errors and deny service to legitimate users.

Detection Guidance

This vulnerability can be detected by checking for unauthorized deletion of WordPress option values via the wpeddpcf_delete_feed function. Inspect WordPress logs for suspicious activity related to the EDD Product Catalog Feed plugin. Look for subscriber-level access attempts to modify or delete plugin-related options.

Impact Analysis

This vulnerability can lead to a denial of service, making your WordPress site inaccessible to legitimate users. Attackers could delete critical site options, causing errors and disrupting normal site functionality.

Mitigation Strategies

Immediately update the EDD Product Catalog Feed plugin to the latest version if an update is available. If no update exists, consider disabling the plugin until a patch is released. Review user roles and permissions to ensure only necessary access is granted. Monitor WordPress option values for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-9331. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70