{"id":"CVE-2026-118093","kind":"vulnerability","aliases":["CVE-2026-118093"],"related":[],"title":"WPFunnels Product Feed Manager: missing authorization check for WooCommerce feeds","description":"Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.","summary":"The WPFunnels Team Product Feed Manager WordPress plugin (best-woocommerce-feed) has a missing authorization check, so access control is not enforced as intended. Per NVD the flaw is rated medium (CVSS 5.3), and the sources do not describe exactly what data or actions an attacker gains.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["best-woocommerce-feed","package","woocommerce","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed version of Product Feed Manager (best-woocommerce-feed) in the WordPress plugins screen or `wp plugin get best-woocommerce-feed --field=version`","fix":"- Product Feed Manager: versions through `7.14.1` are affected; the sources do not name a fixed version","status":"open","published_at":"2026-10-29T13:17:08+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:48+00:00","updated_at":"2026-10-29T13:25:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T13:25:48Z","model":"claude-haiku-5-5","output":{"fix":"- Product Feed Manager: versions through `7.14.1` are affected; the sources do not name a fixed version","reach":"internet","title":"WPFunnels Product Feed Manager: missing authorization check for WooCommerce feeds","impact":"medium","summary":"The WPFunnels Team Product Feed Manager WordPress plugin (best-woocommerce-feed) has a missing authorization check, so access control is not enforced as intended. Per NVD the flaw is rated medium (CVSS 5.3), and the sources do not describe exactly what data or actions an attacker gains.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","best-woocommerce-feed"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin functions","analyst_note":"Find the NVD entry or WPFunnels advisory to confirm the affected endpoint, required privilege, and fixed version.","how_to_check":"- Check the installed version of Product Feed Manager (best-woocommerce-feed) in the WordPress plugins screen or `wp plugin get best-woocommerce-feed --field=version`\n- unknown for other checks: the sources do not say which endpoint or setting is affected","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Product Feed Manager (best-woocommerce-feed) WordPress plugin from WPFunnels up to and including 7.14.1 are in scope. The sources do not say which role or configuration is needed to reach the missing check, so who can skip it is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4126,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118093':13A,16A '-2026':12A,15A '5.3':57B '7.14.1':101C 'access':42B,89C 'action':68B 'affect':94C 'allow':85C 'attack':70B 'author':6A,39B,73C 'best':18B,33B,82C 'best-woocommerce-fe':17B,32B,81C 'check':7A,40B 'configur':88C 'control':43B,90C 'cve':11A,14A 'cvss':56B 'data':66B 'describ':63B 'enforc':46B 'exact':64B 'exploit':86C 'feed':3A,10A,20B,28B,35B,79C,84C,96C 'flaw':52B 'gain':71B 'incorrect':87C 'intend':48B 'issu':93C 'levels.this':92C 'manag':4A,29B,80C,97C 'medium':55B 'miss':5A,38B,72C 'n/a':99C 'nvd':50B 'packag':21B 'per':49B 'plugin':31B 'product':2A,27B,78C,95C 'rate':54B 'secur':91C 'sourc':60B 'team':26B,77C 'vulner':74C 'woocommerc':9A,19B,22B,34B,83C 'wordpress':23B,30B 'wpfunnel':1A,25B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Product Feed Manager (best-woocommerce-feed) WordPress plugin from WPFunnels up to and including 7.14.1 are in scope. The sources do not say which role or configuration is needed to reach the missing check, so who can skip it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118093","severity":null,"published_at":"2026-10-29T13:17:08+00:00","modified_at":"2026-10-29T13:17:08+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}