CVE-2026-16611 - Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure

Back Back to CVE browser

HIGH

Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure

Published Aug 15, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.43%

Description

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.

Affected products

Vendor n/a Product Product Feed PRO for WooCommerce by AdTribes Default
unaffected
Affected
- ≥ 0, < 13.5.7

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Product Feed PRO for WooCommerce by AdTribes	unaffected	Affected ≥ 0, < 13.5.7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59590
Advisory
https://wpscan.com/vulnerability/87fe63af-5a43-4812-88ce-568b1cc1598f/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59590		Advisory
https://wpscan.com/vulnerability/87fe63af-5a43-4812-88ce-568b1cc1598f/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Aug 15, 2026

Updated Aug 17, 2026

Reserved Jul 22, 2026

Link CVE-2026-16611

CISA Vulnrichment

Updated Aug 17, 2026

NVD

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-16611

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Aug 15, 2026

Updated Aug 17, 2026

Link EUVD-2026-59590

GitHub

No data