Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
CVE-2026-87968
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-87968
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.3.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-87968
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #21913 · Revision 1
- Added to Heist Feed
- Publisher date