WordPress Plugin Vulnerabilities

Product Feed for WooCommerce < 2.3.2 - Missing Authorization

Description

The WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
webtoffee-product-feed
Fixed in 2.3.2

References

CVE
CVE-2025-66089
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/04c84f52-7a97-4d86-ab9a-f8b9dfbd213b

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Legion Hunter
Verified
No
WPVDB ID
9344fbdb-4499-462b-983e-4a8ffea11b3a

Timeline

Publicly Published
2025-10-30 (about 7 months ago)
Added
2025-11-25 (about 7 months ago)
Last Updated
2025-11-25 (about 7 months ago)

Other

Published
Title
Published
2025-10-29
Title
Translate WordPress and go Multilingual – Weglot < 5.2 - Missing Authorization to Unauthenticated Limited Transient Deletion
Published
2023-05-16
Title
WP < 6.2.2 - Shortcode Execution in User Generated Data
Published
2025-04-11
Title
Add Product Frontend for WooCommerce <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Published
2026-06-08
Title
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more < 9.4.0.1 - Missing Authorization
Published
2024-08-28
Title
Blockbooster < 1.0.11 - Missing Authorization