{"id":"CVE-2026-118089","kind":"vulnerability","aliases":["CVE-2026-118089"],"related":[],"title":"WordPress Product Feed Manager plugin: PHP object injection lets attackers run code","description":"Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.","summary":"The Product Feed Manager plugin for WordPress WooCommerce stores, versions up to and including 7.14.1, has a PHP object injection flaw. A user with shop manager access can abuse it to inject serialized PHP objects, which can lead to code execution on the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","product-feed-manager","woocommerce","wordpress"],"not_affected_if":["no-shop-manager-accounts","plugin-updated"],"how_to_check":"- Check the installed Product Feed Manager plugin version in the WordPress admin plugins list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.\n- Confirm whether the installed version is `7.14.1` or earlier.","fix":"- Product Feed Manager: move to a version newer than `7.14.1`; the exact fixed version is unknown.","status":"open","published_at":"2026-10-30T19:18:17+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:02+00:00","updated_at":"2026-10-30T19:26:02+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:02Z","model":"claude-haiku-5-5","output":{"fix":"- Product Feed Manager: move to a version newer than `7.14.1`; the exact fixed version is unknown.","reach":"internet","title":"WordPress Product Feed Manager plugin: PHP object injection lets attackers run code","impact":"high","summary":"The Product Feed Manager plugin for WordPress WooCommerce stores, versions up to and including 7.14.1, has a PHP object injection flaw. A user with shop manager access can abuse it to inject serialized PHP objects, which can lead to code execution on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","product-feed-manager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the web server via injected objects","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118089 for the fixed plugin version and the exact trigger path.","how_to_check":"- Check the installed Product Feed Manager plugin version in the WordPress admin plugins list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.\n- Confirm whether the installed version is `7.14.1` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-updated","no-shop-manager-accounts"],"who_is_affected":"Sites running the Product Feed Manager plugin at version 7.14.1 or earlier are exposed. The attacker needs shop manager level access, so sites that limit who holds that role have less exposure. The sources do not say whether a default configuration is affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4054,"output_tokens":614,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118089':15A,18A '-2026':14A,17A '7.14.1':40B,79C 'abus':54B 'access':52B 'attack':10A 'code':12A,65B 'cve':13A,16A 'execut':66B 'feed':3A,22B,28B,77C 'flaw':46B 'includ':39B 'inject':8A,45B,57B,74C 'lead':63B 'let':9A 'manag':4A,23B,29B,51B,71C,78C 'object':7A,44B,60B,73C 'packag':19B 'php':6A,43B,59B,72C 'plugin':5A,30B 'product':2A,21B,27B,76C 'product-feed-manag':20B 'run':11A 'serial':58B 'shop':50B,70C 'site':69B 'store':34B 'user':48B 'version':35B,80C 'woocommerc':24B,33B 'wordpress':1A,25B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Product Feed Manager plugin at version 7.14.1 or earlier are exposed. The attacker needs shop manager level access, so sites that limit who holds that role have less exposure. The sources do not say whether a default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118089","severity":null,"published_at":"2026-10-30T19:18:17+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}