CVE-2026-15258: WooCommerce Product Feed Manager SQLi

CVE-2026-15258 Overview

CVE-2026-15258 is a SQL injection vulnerability in the Product Feed Manager for WooCommerce WordPress plugin before version 7.6.1. The plugin fails to sanitize and escape product-feed custom filter rules before including them in a SQL query. Authenticated users with the Contributor role or higher can inject arbitrary SQL, leading to database compromise. The flaw is tracked as CWE-89 and affects a widely deployed e-commerce feed management plugin.

Critical Impact
An authenticated attacker with Contributor privileges can extract sensitive data from the WordPress database, including user credentials and customer records, by manipulating custom filter rules.

Affected Products

Product Feed Manager for WooCommerce WordPress plugin, versions prior to 7.6.1
WordPress installations running WooCommerce with this plugin enabled
Sites permitting Contributor-level (or higher) user registration or accounts

Discovery Timeline

2026-07-31 - CVE-2026-15258 published to the National Vulnerability Database
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-15258

Vulnerability Analysis

The vulnerability resides in the product-feed custom filter rules handling logic. User-supplied filter rule values are concatenated into a SQL query without proper sanitization or parameterization. Any user with the Contributor role or above can supply crafted input that alters query structure.

The plugin exposes filter-rule creation to lower-privileged authenticated roles. This lowers the exploitation bar compared to admin-only injections. Successful exploitation yields read and write access to the underlying WordPress database, including the wp_users and wp_usermeta tables.

The issue is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Exploitation requires network access and low privileges, and it can be executed without user interaction.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements when constructing SQL queries from custom filter rule fields. The plugin trusts filter-rule content as if it were structured data, when it is actually attacker-controlled text. Standard WordPress $wpdb->prepare() usage would have prevented the flaw.

Attack Vector

An authenticated attacker logs into WordPress with a Contributor (or higher) account. The attacker submits a product feed with crafted custom filter rules that embed SQL operators such as UNION SELECT, boolean tautologies, or time-based payloads. When the plugin evaluates the feed, the injected SQL executes in the database context of the WordPress site, enabling data exfiltration or manipulation.

No verified proof-of-concept exploitation code is publicly available. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-15258

Indicators of Compromise

Unusual query patterns in MySQL slow-query or general logs referencing product-feed filter rule tables
Requests to plugin AJAX or REST endpoints containing SQL keywords such as UNION, SLEEP(, INFORMATION_SCHEMA, or -- within filter-rule parameters
New or modified WordPress administrator accounts created shortly after Contributor account activity
Unexpected outbound traffic from the WordPress host following filter-rule submissions

Detection Strategies

Inspect web server access logs for POST requests to Product Feed Manager endpoints containing encoded SQL metacharacters
Correlate authenticated Contributor account activity with database error spikes or long-running queries
Deploy web application firewall rules that flag SQL syntax within wpm_* or feed-rule request parameters

Monitoring Recommendations

Enable WordPress audit logging to track feed creation and modification events by user role
Forward MySQL error logs and WordPress debug.log to a centralized data lake for correlation
Alert on any Contributor-role account submitting or editing product feeds outside expected workflows

How to Mitigate CVE-2026-15258

Immediate Actions Required

Upgrade the Product Feed Manager for WooCommerce plugin to version 7.6.1 or later without delay
Audit all Contributor, Author, Editor, and Administrator accounts and remove untrusted or dormant users
Review recent product feeds and filter rules for suspicious payloads or unexpected authors
Rotate WordPress administrator passwords and any secrets stored in the database if compromise is suspected

Patch Information

The vendor has released version 7.6.1 of the Product Feed Manager for WooCommerce plugin, which properly sanitizes and escapes custom filter rule input before use in SQL queries. Update through the WordPress plugin dashboard or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict Contributor and higher-role registrations until the plugin is updated
Temporarily deactivate the Product Feed Manager for WooCommerce plugin if patching is not immediately feasible
Deploy WAF signatures that block SQL metacharacters in plugin request parameters
Enforce the principle of least privilege by demoting users who do not require Contributor access

bash

# Update the plugin using WP-CLI
wp plugin update webappick-product-feed-for-woocommerce --version=7.6.1

# Verify installed version
wp plugin get webappick-product-feed-for-woocommerce --field=version

# Temporarily deactivate if patch cannot be applied immediately
wp plugin deactivate webappick-product-feed-for-woocommerce