Live › vulnerability › CVE-2026-118093
The WPFunnels Team Product Feed Manager WordPress plugin (best-woocommerce-feed) has a missing authorization check, so access control is not enforced as intended. Per NVD the flaw is rated medium (CVSS 5.3), and the sources do not describe exactly what data or actions an attacker gains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Sites running the Product Feed Manager (best-woocommerce-feed) WordPress plugin from WPFunnels up to and including 7.14.1 are in scope. The sources do not say which role or configuration is needed to reach the missing check, so who can skip it is unknown.
No product ranges from the sources yet.
wp plugin get best-woocommerce-feed --field=version7.14.1 are affected; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118093")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.