{"id":"CVE-2026-118078","kind":"vulnerability","aliases":["CVE-2026-118078"],"related":[],"title":"PixelYourSite Product Catalog Feed: PHP object injection by shop managers","description":"Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.","summary":"The PixelYourSite Product Catalog Feed WordPress plugin, versions 3.1.4 and earlier, has a PHP object injection flaw. A shop manager account can abuse it to inject serialized PHP objects, which can lead to code execution depending on the site's available classes.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Product Catalog Feed by PixelYourSite","fixed":[],"affected":"<= 3.1.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","php-object-injection","pixelyoursite","shop-manager","woocommerce","wordpress"],"not_affected_if":["no-shop-manager-accounts","plugin-not-installed","plugin-updated"],"how_to_check":"- In WordPress admin > Plugins, find 'Product Catalog Feed by PixelYourSite' and read its version; 3.1.4 or earlier is listed as affected by Patchstack/NVD.\n- Or run: wp plugin list --name=product-catalog-feed --fields=name,version,status\n- Note: version numbers may not line up with the vendor's 5.x changelog; if unsure, ask the vendor.","fix":null,"status":"open","published_at":"2026-10-29T16:18:02+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:46+00:00","updated_at":"2026-10-29T16:38:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:29:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PixelYourSite Product Catalog Feed: PHP object injection by shop managers","impact":"high","summary":"The PixelYourSite Product Catalog Feed WordPress plugin, versions 3.1.4 and earlier, has a PHP object injection flaw. A shop manager account can abuse it to inject serialized PHP objects, which can lead to code execution depending on the site's available classes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","pixelyoursite"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with shop manager access injects objects, possibly executing code.","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and whether the flaw needs a gadget chain to reach code execution.","how_to_check":"- Check the installed version of the PixelYourSite Product Catalog Feed plugin in the WordPress admin plugins list.\n- Treat any version `3.1.4` or earlier as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"WordPress sites running the PixelYourSite Product Catalog Feed plugin at version 3.1.4 or earlier, where shop manager accounts exist. The sources do not say whether the flaw is reachable without the shop manager role.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":4072,"output_tokens":550,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and whether the flaw needs a gadget chain to reach code execution.","search":"'-118078':13A,16A '-2026':12A,15A '3.1.4':41B,86C 'abus':55B 'account':53B 'avail':73B 'by':20A 'catalog':3A,18A,36B,82C 'class':74B 'code':66B 'cve':11A,14A 'depend':68B 'earlier':43B 'execut':67B 'feed':4A,19A,37B,83C 'flaw':49B 'inject':7A,26B,48B,58B,79C 'lead':64B 'manag':10A,30B,52B,76C 'object':6A,25B,47B,61B,78C 'packag':22B 'php':5A,24B,46B,60B,77C 'php-object-inject':23B 'pixelyoursit':1A,27B,34B,85C 'pixelyoursite':21A 'plugin':39B 'product':2A,17A,35B,81C 'serial':59B 'shop':9A,29B,51B,75C 'shop-manag':28B 'site':71B 'version':40B,87C 'woocommerc':31B 'wordpress':32B,38B","nicknames":[],"mitigations":[],"who_affected":"WordPress/WooCommerce sites running the Product Catalog Feed by PixelYourSite plugin (slug product-catalog-feed) at 3.1.4 or earlier. Exploitation needs a logged-in Shop Manager (or higher) account, so risk is mainly stores with several staff, agencies or a compromised manager account. Impact depends on gadget classes from other installed plugins. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118078","severity":null,"published_at":"2026-10-29T16:18:02+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118078:1077","url":null,"severity":null,"published_at":"2026-10-29T16:38:28+00:00","modified_at":"2026-10-29T16:38:28+00:00","first_seen_at":"2026-10-29T16:38:28+00:00","fetched_at":"2026-10-29T16:38:28+00:00","note":"NVD/Patchstack (CNA): CWE-502, <=3.1.4, shop manager (PR:H) required, CVSS 7.2. Patchstack says no official patch; vendor changelog (Pro line is at 5.9.4) mentions no security fix, so fix is unknown. Version numbering is odd: wp.org free plugin is 2.2.0 and Pro is 5.x, so '3.1.4' does not map clearly to either; ask Patchstack/vendor. Gadget chain: not stated, RCE depends on classes present (WooCommerce/other plugins). Not exploited, no PoC found. Nothing verified (no vendor statement)."}],"documents":[{"id":17804,"url":"https://patchstack.com/database/wordpress/plugin/product-catalog-feed/vulnerability/wordpress-product-catalog-feed-by-pixelyoursite-plugin-3-1-4-php-object-injection-vulnerability","title":"Patchstack: Product Catalog Feed by PixelYourSite <= 3.1.4 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17805,"url":"https://www.pixelyoursite.com/product-catalog-feeds-for-woocommerce-logs","title":"PixelYourSite: Product Catalog Feed for WooCommerce change log","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":17806,"url":"https://wordpress.org/plugins/product-catalog-feed/","title":"wordpress.org: Product Catalog Feed by PixelYourSite (v2.2.0, 2023)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}