Executive brief
The Product Feed Manager for WooCommerce plugin, which helps online stores sync their products with marketing platforms like Google Shopping, contains a security flaw. This vulnerability allows users with low-level access, such as guest contributors, to run unauthorized database commands. An attacker could use this to steal sensitive information, including customer data or administrator password hashes, potentially leading to a full site takeover.
Technical details
A SQL injection vulnerability exists in the Product Feed Manager for WooCommerce plugin due to insufficient sanitization of custom filter rules in the 'ff' parameter. The plugin uses FILTER_SANITIZE_FULL_SPECIAL_CHARS, which fails to block characters like parentheses and mathematical operators, allowing for quote-free time-based or boolean-based blind SQL injection. An attacker with Contributor-level privileges (edit_posts capability) can inject malicious SQL into a feed's filter rules. The payload is executed when the feed is generated, either by an administrator or via scheduled cron jobs, allowing for the extraction of sensitive information such as user password hashes. This issue is fixed in version 7.6.1.
Affected products
- Unknown Product Feed Manager For WooCommerce < 7.6.1
Timeline
- 2026-07-13: disclosed
- 2026-07-31: advisory: NVD publication date
- 7.6.1: patched