Code Injection Vulnerability in WPFactory Product XML Feed Manager for WooCommerce
CVE-2025-49887

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Product Xml Feed Manager For WooCommerce
Vendor
CVE Published:
14 August 2025

What is CVE-2025-49887?

A vulnerability in the WPFactory Product XML Feed Manager for WooCommerce allows for remote code inclusion. This flaw can be exploited by sending specially crafted requests to the server, leading to the execution of arbitrary code. Affected versions include all prior to 2.9.3, posing significant risks to websites utilizing this plugin. It is imperative for users to update to the latest version to mitigate potential threats associated with unauthorized code execution.

Affected Version(s)

Product XML Feed Manager for WooCommerce <= 2.9.3

References

https://patchstack.com/database/wordpress/plugin/product-...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17 (Patchstack Alliance)
.