CVE-2026-103349— WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability
Quick assessment
Affected
Rymera Web Co Product Feed PRO for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WooCommerce 插件 Rymera Web Co Product Feed PRO (woo-product-feed-pro) 中存在不信任数据反序列化漏洞，可导致对象注入。此漏洞影响 WooCommerce Product Feed PRO 插件的以下版本：从初始版本到 13.5.7。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Rymera Web Co | Product Feed PRO for WooCommerce | ≤ 13.5.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103349
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rymera Web Co | Product Feed PRO for WooCommerce | 0 ~ 13.5.7 | - |
|
II. Public POCs for CVE-2026-103349
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103349
请登录查看更多情报信息。
Other References for CVE-2026-103349 (1)
IV. Related Vulnerabilities
Same product: Product Feed PRO for WooCommerce
-
CVE-2026-32443
WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 -
CVE-2024-32513
WordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 -
CVE-2024-24800
WordPress Product Feed PRO for WooCommerce plugin <= 13.2.5 -
CVE-2022-46793
WordPress Product Feed PRO for WooCommerce Plugin <= 12.4.4 -
CVE-2022-0426
Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-
Same vendor: Rymera Web Co
-
CVE-2026-54838
WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injec -
CVE-2024-38745
WordPress Wholesale Suite plugin <= 2.1.12 - Broken Access C -
CVE-2022-34344
WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to B -
CVE-2022-41640
WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to C -
CVE-2022-43481
WordPress Advanced Coupons for WooCommerce Coupons plugin <=
Same weakness: CWE-502
-
CVE-2026-97257
WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object -
CVE-2026-100511
WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PH -
CVE-2026-93617
WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object I -
CVE-2026-100506
WordPress WP Spell Check plugin <= 12.1 - PHP Object Injecti -
CVE-2026-103348
WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object In
V. Comments for CVE-2026-103349
No comments yet