Missing Authorization in Datafeedr Product Sets Plugin for WordPress
CVE-2026-116107

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Product Sets Plugin
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116107?

A vulnerability has been identified in the Datafeedr Product Sets Plugin for WordPress, specifically within the AJAX Handlers component. This issue arises from the function dfrps_ajax_delete_saved_search in the file functions/ajax.php, where inadequate authorization checks allow for remote exploitation. Attackers could leverage this flaw to manipulate saved searches without proper permissions. It is strongly advised that users upgrade to version 1.3.25 to mitigate this vulnerability and ensure the security of their installations.

Affected Version(s)

Product Sets Plugin 1.3.0

Product Sets Plugin 1.3.1

Product Sets Plugin 1.3.2

References

https://vuldb.com/vuln/426175
vdb-entrytechnical-description
https://vuldb.com/vuln/426175/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116107
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

scription (VulDB User)
VulDB CNA Team
.