CVE-2026-19778 Overview
CVE-2026-19778 is a time-based SQL injection vulnerability in the WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress. The flaw affects all versions up to and including 2.23.7. It stems from insufficient escaping of the user-supplied feed parameter and a lack of proper preparation of the underlying SQL query [CWE-89]. Authenticated attackers with administrator-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database.
Critical Impact
Administrator-authenticated attackers can execute time-based SQL injection through the feed parameter to exfiltrate sensitive data from the WordPress database.
Affected Products
- WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress
- All plugin versions up to and including 2.23.7
- WordPress installations running the vulnerable wp-product-feed-manager plugin
Discovery Timeline
- 2026-09-09 - CVE-2026-19778 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-19778
Vulnerability Analysis
The vulnerability resides in the plugin's feed data handling logic. The feed parameter passes user-controlled input into SQL queries without adequate sanitization or parameterized query construction. Attackers can inject additional SQL clauses that execute alongside the intended query. Because the injection is time-based, attackers infer data by measuring response delays introduced through functions such as SLEEP() or BENCHMARK().
The affected code paths include class-wppfm-ajax-data.php, class-wppfm-data.php, class-wppfm-feed-crud-handler.php, and class-wppfm-queries.php. Review the WordPress Queries Class and the WordPress Feed CRUD Handler for the vulnerable query construction. Although exploitation requires administrator privileges, the flaw expands the attack surface for privilege abuse, insider threats, and compromised admin accounts.
Root Cause
The root cause is missing use of WordPress prepared statements. The feed parameter reaches SQL concatenation logic without passing through $wpdb->prepare() or equivalent escaping. This violates the guidance in [CWE-89] by failing to separate SQL code from data.
Attack Vector
Exploitation occurs over the network through authenticated HTTP requests to the plugin's AJAX endpoints. An attacker holding administrator credentials submits a crafted feed parameter value containing conditional time-delay payloads. The database response latency reveals the truth value of injected boolean conditions, enabling blind data extraction.
See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2026-19778
Indicators of Compromise
- HTTP requests to plugin AJAX endpoints containing feed parameter values with SQL keywords such as SLEEP, BENCHMARK, UNION, or comment sequences (--, #, /*).
- Unusually long response times from admin-ajax.php requests referencing wppfm actions.
- WordPress database query logs showing malformed or concatenated queries originating from the wp-product-feed-manager plugin.
Detection Strategies
- Enable MySQL slow query logging and correlate long-running queries with authenticated admin sessions accessing the plugin.
- Deploy a Web Application Firewall (WAF) rule to flag SQL syntax in the feed parameter of requests targeting wp-product-feed-manager endpoints.
- Audit WordPress administrator account activity for unexpected use of feed management features, particularly from unusual IP addresses.
Monitoring Recommendations
- Forward WordPress access logs, PHP error logs, and MySQL query logs to a centralized analytics platform for correlation.
- Alert on administrator logins from new geographies or user-agent strings preceding requests to plugin endpoints.
- Track file integrity of the wp-product-feed-manager plugin directory to detect tampering following exploitation.
How to Mitigate CVE-2026-19778
Immediate Actions Required
- Update the WPMR Google Feed Manager for WooCommerce plugin to a version later than 2.23.7 as soon as the vendor releases a patched build.
- Rotate WordPress administrator passwords and enforce multi-factor authentication on all privileged accounts.
- Review recent administrator activity and database access logs for signs of SQL injection attempts.
Patch Information
The vendor released a fix tracked in the WordPress Plugin Changeset. Site administrators should upgrade to the patched release published after version 2.23.7. Confirm the installed plugin version through the WordPress admin dashboard after upgrading.
Workarounds
- Deactivate the WPMR Google Feed Manager plugin until the patched version is installed if feed generation is not business-critical.
- Restrict administrator access to trusted network ranges through WordPress .htaccess or reverse proxy rules.
- Deploy WAF signatures that block SQL metacharacters in requests to wp-admin/admin-ajax.php referencing wppfm actions.
# Configuration example: restrict wp-admin to trusted IPs via .htaccess
<Files admin-ajax.php>
Require ip 203.0.113.0/24
Require ip 198.51.100.10
</Files>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
