Product Sets Plugin
Product Sets Plugin (datafeedr-product-sets) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Oct 26, 2026; the highest published CVSS base score is 2.1.
datafeedr-product-setsThis measures remediation-data coverage in this archive. It is not a claim that the plugin is vulnerability-free or insecure.
CVE-2026-116107: Datafeedr Product Sets: Missing authorization for saved-search deletion
Datafeedr Product Sets exposes missing authorization in dfrps_ajax_delete_saved_search in functions/ajax.php. The CVSS 4.0 vector requires low-privilege authenticated access and scores limited integrity and availability impacts; the minimum WordPress role, request parameters and object-ownership rules are not disclosed in the export. The affected operation concerns saved-search deletion, not arbitrary filesystem deletion. The CNA states that an exploit is public; this archive has not retrieved or tested it. Published affected versions: 1.3.0 through 1.3.24 (enumerated by the CNA).
| Safe version |
|
||
|---|---|---|---|
| Oct 26, 2026 |
CVE-2026-116107
Datafeedr Product Sets: Missing authorization for saved-search deletion
Datafeedr Product Sets exposes missing authorization in dfrps_ajax_delete_saved_search in functions/ajax.php. The CVSS 4.0 vector requires low-privilege authenticated access and scores limited integrity and availability impacts; the minimum WordPress role, request parameters and object-ownership rules are not disclosed in the export. The affected operation concerns saved-search deletion, not arbitrary filesystem deletion. The CNA states that an exploit is public; this archive has not retrieved or tested it. Published affected versions: 1.3.0 through 1.3.24 (enumerated by the CNA).
|
1.3.25 |
CVE2.1
|