CVE-2026-87968: WooCommerce Product Feed Auth Bypass Flaw

CVE-2026-87968 Overview

CVE-2026-87968 affects the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before version 5.3.2. The plugin exposes an AJAX action that registers the store with its feed service without performing a nonce or capability check. Unauthenticated visitors can invoke this action and force the store to re-register, overwriting the plugin's stored shop secret. The flaw is categorized as a broken access control issue [CWE-284] affecting integrity of plugin configuration data.

Critical Impact
Any unauthenticated visitor can overwrite the stored shop secret used by the plugin to communicate with the feed service, disrupting product feed integrations.

Affected Products

Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin versions prior to 5.3.2
WordPress sites running WooCommerce with this plugin installed
Merchants relying on Google Shopping, Microsoft Advertising, and additional feed channels through this plugin

Discovery Timeline

2026-10-14 - CVE-2026-87968 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-87968

Vulnerability Analysis

The plugin registers an AJAX endpoint that handles store registration with the vendor's feed service. The handler is wired to both wp_ajax_ and wp_ajax_nopriv_ hooks, exposing it to unauthenticated users. The handler does not call check_ajax_referer() for nonce validation and does not perform a current_user_can() capability check. An attacker who sends a crafted request to admin-ajax.php triggers re-registration and overwrites the stored shop secret the plugin uses to authenticate with its feed backend.

Because the shop secret binds the WooCommerce store to the external feed service, overwriting it can break ongoing feed synchronization. Attackers cannot read site content through this flaw, but they can repeatedly corrupt the integration, producing an integrity impact on plugin configuration state.

Root Cause

The root cause is missing authorization and missing request-origin verification on a privileged AJAX action. The handler trusts any caller to initiate registration, which should be restricted to administrators with a valid nonce. This matches [CWE-284] Improper Access Control.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker issues an unauthenticated HTTP POST to the plugin's AJAX action on /wp-admin/admin-ajax.php. No user interaction, authentication, or special configuration is required. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-87968

Indicators of Compromise

Unexpected changes to the plugin's stored shop secret in the WordPress options table
Repeated unauthenticated POST requests to admin-ajax.php targeting the plugin's registration action
Feed synchronization failures or authentication errors reported by Google Shopping or Microsoft Advertising channels

Detection Strategies

Review web server logs for anonymous requests to admin-ajax.php with the plugin's registration action parameter
Monitor WordPress option changes related to the plugin's shop secret and registration state
Alert on bursts of POST requests to admin-ajax.php from a single source IP without an authenticated session cookie

Monitoring Recommendations

Enable WordPress audit logging for plugin option updates and administrative setting changes
Forward web access logs and WordPress application logs to a centralized SIEM for correlation
Track feed service API error rates to detect integration disruption caused by secret rotation

How to Mitigate CVE-2026-87968

Immediate Actions Required

Upgrade the plugin to version 5.3.2 or later on all affected WordPress sites
Verify the stored shop secret and re-register the store with the feed service if tampering is suspected
Restrict access to /wp-admin/admin-ajax.php with a web application firewall rule that filters the vulnerable action for unauthenticated callers

Patch Information

Upgrade to Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant version 5.3.2 or later. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the plugin until the patched version is deployed
Deploy a WAF rule to block unauthenticated POST requests to admin-ajax.php that target the plugin's registration action
Limit access to admin-ajax.php by IP allowlist where feasible for environments with a known administrator source range

bash

# Example WAF rule concept to block unauthenticated access to the plugin's AJAX action
# Adapt the action name to the exact value used by the plugin handler
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026087968"
SecRule ARGS:action "@rx ^(?i)product_feed_register_action$" \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"