Live › vulnerability › CVE-2026-118089
The Product Feed Manager plugin for WordPress WooCommerce stores, versions up to and including 7.14.1, has a PHP object injection flaw. A user with shop manager access can abuse it to inject serialized PHP objects, which can lead to code execution on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Product Feed Manager plugin at version 7.14.1 or earlier are exposed. The attacker needs shop manager level access, so sites that limit who holds that role have less exposure. The sources do not say whether a default configuration is affected.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version if WP-CLI is available.7.14.1 or earlier.7.14.1; the exact fixed version is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118089")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.