PT-2026-31069 · Jkohlbach · Product Feed Pro For Woocommerce By Adtribes – Product Feeds For Woocommerce

Lucky_Buddy · Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-3499

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 through 13.5.2.1. This is due to missing or incorrect nonce validation on the ajax migrate to custom post type, ajax adt clear custom attributes product meta keys, ajax update file url to lower case, ajax use legacy filters and rules, and ajax fix duplicate feed functions. This makes it possible for unauthenticated attackers to trigger feed migration, clear custom-attribute transient caches, rewrite feed file URLs to lowercase, toggle legacy filter and rule settings, and delete duplicated feed posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-3499

Affected Products

Product Feed Pro For Woocommerce By Adtribes – Product Feeds For Woocommerce

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-3499 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5b645b88-85e0-4e89-bd95-444ab1db6df8?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3476067/woo-product-feed-pro · Note