---
id: "CVE-2026-118093"
kind: "vulnerability"
aliases: ["CVE-2026-118093"]
title: "WPFunnels Product Feed Manager: missing authorization check for WooCommerce feeds"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["best-woocommerce-feed", "package", "woocommerce", "wordpress"]
not_affected_if: []
published_at: "2026-10-29T13:17:08+00:00"
first_seen_at: "2026-10-29T13:25:07+00:00"
updated_at: "2026-10-29T13:25:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118093", "first_seen_at": "2026-10-29T13:25:07+00:00"}]
---

# WPFunnels Product Feed Manager: missing authorization check for WooCommerce feeds

The WPFunnels Team Product Feed Manager WordPress plugin (best-woocommerce-feed) has a missing authorization check, so access control is not enforced as intended. Per NVD the flaw is rated medium (CVSS 5.3), and the sources do not describe exactly what data or actions an attacker gains.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Product Feed Manager (best-woocommerce-feed) in the WordPress plugins screen or `wp plugin get best-woocommerce-feed --field=version`

## Fix

- Product Feed Manager: versions through `7.14.1` are affected; the sources do not name a fixed version

## Timeline

- 2026-10-29T13:25:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118093

## From the sources

Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_