[ CVE-2026-87968 · Published 14 Oct 2026 ]
Vulnerability in Unknown Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.