CVE-2026-9331: WordPress EDD Product Catalog Feed DoS Flaw

CVE-2026-9331 Overview

CVE-2026-9331 affects the EDD Product Catalog Feed by PixelYourSite plugin for WordPress. The plugin fails to enforce a capability check on the wpeddpcf_delete_feed function in all versions up to and including 1.0.2. Authenticated attackers with subscriber-level access or above can delete arbitrary option values from the WordPress database. Deleting a required option corrupts site state and denies service to legitimate users. The flaw is categorized under CWE-862: Missing Authorization.

Critical Impact
Any authenticated user with subscriber privileges can trigger a denial of service by deleting arbitrary WordPress option values, disrupting site availability.

Affected Products

EDD Product Catalog Feed by PixelYourSite for WordPress
All plugin versions through 1.0.2
WordPress sites permitting subscriber-level registration

Discovery Timeline

2026-09-08 - CVE-2026-9331 published to the National Vulnerability Database
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-9331

Vulnerability Analysis

The vulnerability resides in the wpeddpcf_delete_feed function exposed by the EDD Product Catalog Feed plugin. The function accepts a request to delete a feed but does not verify that the requesting user holds an administrative capability. Because WordPress feeds are stored as options in the wp_options table, the handler ultimately invokes delete_option() against an attacker-controlled key. Any authenticated user, including subscribers created through open registration, can invoke the handler and remove arbitrary option values. Deleting foundational options such as siteurl, home, or active theme entries breaks page rendering and produces fatal errors for all visitors.

Root Cause

The root cause is a missing current_user_can() capability check within the AJAX or admin-post handler that services feed deletion. The plugin also lacks server-side validation restricting the target option name to a plugin-owned allow list. Nonce verification alone, if present, does not constrain which authenticated role can act.

Attack Vector

Exploitation requires network access to the WordPress admin-ajax or admin-post endpoint and a valid low-privilege session. The attacker submits a crafted request naming the option key to delete. No user interaction from an administrator is required, and the request completes with a single HTTP call. Refer to the Wordfence advisory for technical details of the vulnerable handler.

Detection Methods for CVE-2026-9331

Indicators of Compromise

POST requests to wp-admin/admin-ajax.php referencing the wpeddpcf_delete_feed action from non-administrator sessions.
Unexpected fatal errors or white-screen conditions immediately following authenticated subscriber activity.
Missing rows in the wp_options table for keys the plugin does not own, such as siteurl or template.
Audit log entries showing delete_option operations originating from low-privilege user IDs.

Detection Strategies

Inspect web server access logs for the wpeddpcf_delete_feed action parameter and correlate with the authenticated user role.
Enable a WordPress audit-logging plugin to record option deletions and role context for every mutation.
Alert when subscriber or contributor accounts issue POST requests to administrative AJAX actions.

Monitoring Recommendations

Baseline the contents of the wp_options table and alert on deletion of critical keys.
Monitor for HTTP 500 responses and PHP fatal errors that appear after low-privilege session activity.
Track new subscriber account registrations followed within minutes by admin-ajax POST traffic.

How to Mitigate CVE-2026-9331

Immediate Actions Required

Deactivate the EDD Product Catalog Feed by PixelYourSite plugin until a patched release is verified.
Disable open WordPress registration or restrict the default role to reduce the pool of accounts able to trigger the handler.
Back up the wp_options table so critical values can be restored quickly if deletion occurs.
Review existing user accounts and remove untrusted subscriber-level users.

Patch Information

No fixed version is identified in the referenced advisory at publication. Consult the PixelYourSite plugin page and the Wordfence Vulnerability Report for the latest release information and upgrade guidance.

Workarounds

Block requests to admin-ajax.php and admin-post.php carrying the wpeddpcf_delete_feed action at the web application firewall.
Enforce a WAF rule restricting the action to requests originating from authenticated administrator sessions.
Remove the plugin directory from the WordPress installation if it is not business-critical.

bash

# Example nginx rule to block the vulnerable action for all requests
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "wpeddpcf_delete_feed") {
        return 403;
    }
}