Executive Summary

A SQL injection vulnerability was discovered in the Product Feed Manager plugin for WordPress, affecting versions up to 7.12.0. This vulnerability, tracked as CVE-2026-66580, has a CVSS score of 8.5 and could allow an attacker to compromise the confidentiality of the database. While there is no active exploitation, immediate action is required to mitigate this vulnerability.

Technical Analysis

This vulnerability is classified as a SQL injection (CWE-89) and is caused by insufficient input validation. The attack vector is network-based (AV:N), with low attack complexity (AC:L) and low privileges required (PR:L). An attacker can exploit this vulnerability by sending a crafted SQL query to the affected plugin, potentially leading to high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L).

How It Gets Exploited

An attacker with low privileges (e.g., a contributor) could exploit this vulnerability by sending a crafted SQL payload to the plugin's SQL query endpoint. For example, an attacker might submit a malformed request with a SQL injection payload in the `product_feed` parameter. If successful, the attacker could execute arbitrary SQL queries on the database, potentially leading to data exfiltration or further exploitation.

Impact Assessment

The Product Feed Manager plugin versions up to 7.12.0 are affected. Successful exploitation could allow an attacker to compromise the confidentiality of the database, potentially leading to sensitive data disclosure. The CVSS score of 8.5 indicates a high severity vulnerability.

Recommended Actions

To mitigate this vulnerability, update the Product Feed Manager plugin to version 7.12.1 or later. Additionally, consider implementing a web application firewall (WAF) rule to detect and block suspicious SQL queries. Monitor plugin and database logs for potential exploitation attempts.

Sources

  • National Vulnerability Database (NVD)
  • Patchstack