WordPress security changelog
LOW CVE-2026-116107 Received

Datafeedr Product Sets: Missing authorization for saved-search deletion

Datafeedr Product Sets exposes missing authorization in dfrps_ajax_delete_saved_search in functions/ajax.php. The CVSS 4.0 vector requires low-privilege authenticated access and scores limited integrity and availability impacts; the minimum WordPress role, request parameters and object-ownership rules are not disclosed in the export. The affected operation concerns saved-search deletion, not arbitrary filesystem deletion. The CNA states that an exploit is public; this archive has not retrieved or tested it. Published affected versions: 1.3.0 through 1.3.24 (enumerated by the CNA).

CVE / CNA score 2.1 CVSS 4.0 · cna@vuldb.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Product Sets Plugin
Plugin slug
datafeedr-product-sets
Affected
1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.3.10, 1.3.11, 1.3.12, 1.3.13, 1.3.14, 1.3.15, 1.3.16, 1.3.17, 1.3.18, 1.3.19, 1.3.20, 1.3.21, 1.3.22, 1.3.23, 1.3.24
Safe version
1.3.25
Published
Oct 26, 2026
Weakness
CWE-862 — Missing Authorization
CWE-863 — Incorrect Authorization

This CVE was published Oct 26, 2026 and is one of 1 known issue for this plugin.

What to do

Update, patch or deactivate.

Update Product Sets Plugin to 1.3.25 or later. Require the appropriate capability and saved-search authorization before deletion; a nonce alone is not authorization. Review unexpected saved-search changes.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

CVE / CNA vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Primary and upstream sources