Authorization Vulnerability in EDD Product Catalog Feed Plugin for WordPress

The EDD Product Catalog Feed plugin for WordPress, developed by PixelYourSite, contains a critical authorization flaw identified as CVE-2026-9331. The vulnerability exists within the wpeddpcf_delete_feed function, which lacks appropriate capability checks. All versions up to and including 1.0.2 are affected. This flaw permits any authenticated user, including those with minimal subscriber-level permissions, to invoke the function and delete arbitrary option values from the WordPress database. By targeting critical site configuration options, an attacker can trigger internal server errors or catastrophic site misconfigurations, effectively resulting in a denial-of-service condition for legitimate users and administrators. This vulnerability highlights the necessity of strict privilege verification for all administrative actions within WordPress plugins.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized modification of site settings. By deleting essential options, attackers can render the WordPress site inaccessible or non-functional, causing significant service disruption. The risk is heightened by the low level of access required to exploit the flaw, as any user account can trigger the deletion.

Recommendation

Update the EDD Product Catalog Feed plugin to the latest version available that addresses this authorization flaw. Ensure that site administrators audit plugin-related database activity to identify unauthorized modifications to the wp_options table. Restrict registration for untrusted users to minimize the pool of potential attackers who could exploit this flaw.