What the vulnerability does
01Description
The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 through 13.5.2.1. This is due to missing or incorrect nonce validation on the ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed functions. This makes it possible for unauthenticated attackers to trigger feed migration, clear custom-attribute transient caches, rewrite feed file URLs to lowercase, toggle legacy filter and rule settings, and delete duplicated feed posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Product Feed PRO for WooCommerce versions 13.4.6 through 13.5.2.1 contain a cross-site request forgery (CSRF) vulnerability. An attacker can trick a logged-in site administrator into performing unwanted actions by visiting a malicious webpage. This could allow the attacker to modify plugin settings, export product data, or alter feed configurations without the admin's knowledge or consent.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into performing unwanted actions like changing plugin settings or exporting product data.
Potential impact on your site
04Site Impact
An attacker could modify your product feeds, export sensitive data, or change plugin configuration without your permission.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit a page controlled by the attacker (e.g., click a malicious link).
Key dates
06Disclosure timeline
April 8, 2026
CVE published
April 8, 2026
Record updated
