SQL Injection Vulnerability in Product Feed Manager by WordPress
CVE-2026-66580

8.5HIGH

Key Information:

Vendor

WordPress
Status
Product Feed Manager
Vendor
CVE Published:
17 September 2026

What is CVE-2026-66580?

The Product Feed Manager plugin for WordPress is affected by a SQL Injection vulnerability that allows attackers to manipulate database queries. This issue exists in versions up to and including 7.12.0. Successful exploitation could lead to unauthorized database access and potential data breaches. Users of the affected plugin should apply the latest updates to mitigate the risk and protect their sites from malicious attacks.

Affected Version(s)

Product Feed Manager <= 7.12.0

References

https://patchstack.com/database/wordpress/plugin/best-woo...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Ryan Albon | Patchstack Bug Bounty Program
.