Live › vulnerability › CVE-2026-116107
Go to dashboardThe Datafeedr Product Sets plugin for WordPress up to version 1.3.24 has an AJAX handler that deletes saved searches without checking authorization. A remote attacker can trigger the deletion of saved searches, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 02:39 UTC. All times on this page are UTC.
Sites running the Datafeedr Product Sets plugin at version 1.3.24 or earlier are exposed, because the saved-search deletion endpoint lacks an authorization check and can be reached remotely. Sites that do not have this plugin installed are not affected.
No product ranges from the sources yet.
wp plugin get datafeedr-product-sets if WP-CLI is availabledfrps_ajax_delete_saved_search in functions/ajax.php of the plugin1.3.25 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-116107")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.