CVE-2026-87968 Details
Description
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
A vulnerability exists in the Product Feed for Google Shopping, Microsoft Advertising, and WooCommerce Merchant WordPress plugin, affecting versions prior to 5.3.2. The issue arises because the plugin does not implement nonce or capability checks on the AJAX action that registers stores with their feed service. This oversight exposes the action to unauthenticated users, allowing any visitor to force a store to re-register and overwrite the previously stored shop secret.
Users are advised to update the Product Feed for Google Shopping, Microsoft Advertising, and WooCommerce Merchant WordPress plugin to version 5.3.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/92b501c0-e237-4dd5-a88a-8472398b1c7e/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Product Feed for Google Shopping | < 5.3.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |