Authorization Bypass in Product Feed PRO for WooCommerce by AdTribes
CVE-2026-16611
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16611?
The Product Feed PRO plugin for WooCommerce prior to version 13.5.7 is susceptible to an authorization bypass due to a lack of proper checks on one of its REST read routes. This flaw permits unauthenticated users to access and disclose sensitive store feed configurations, including rules, filters, and field mapping. Additionally, attackers may enumerate the complete product category taxonomy, which could further compromise the integrity and confidentiality of the store's data.
Affected Version(s)
Product Feed PRO for WooCommerce by AdTribes 0 < 13.5.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.