Read the docs
TI-2026-80240 Aliases CVE-2026-116107GHSA-5r9h-jfp8-wfxv

Missing authorization in Datafeedr Product Sets Plugin AJAX handler

Priority MEDIUM 57CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Datafeedr Product Sets Plugin for WordPress from 1.3.0 before 1.3.25 is affected. The dfrps_ajax_delete_saved_search function in the AJAX handlers of functions/ajax.php lacks an authorization check (CWE-862). A remote attacker with low privileges can change or disrupt data. The exploit is publicly disclosed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Fix Fixed Product Sets Plugin (Datafeedr): 1.3.25

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DatafeedrProduct Sets Plugin1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7; 1.3.8; 1.3.9; 1.3.10; 1.3.11; 1.3.12; 1.3.13; 1.3.14; 1.3.15; 1.3.16; 1.3.17; 1.3.18; 1.3.19; 1.3.20; 1.3.21; 1.3.22; 1.3.23; 1.3.241.3.25Patch availableCNA
  • Product Sets Plugin VendorDatafeedr Affected 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7; 1.3.8; 1.3.9; 1.3.10; 1.3.11; 1.3.12; 1.3.13; 1.3.14; 1.3.15; 1.3.16; 1.3.17; 1.3.18; 1.3.19; 1.3.20; 1.3.21; 1.3.22; 1.3.23; 1.3.24 Fixed in 1.3.25 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:datafeedr:product_sets_plugin:*:*:*:*:*:*:*:*——Datafeedr
  • cpe:2.3:a:datafeedr:product_sets_plugin:*:*:*:*:*:*:*:* Versions — — ·Datafeedr

Remediation

Upgrade Datafeedr Product Sets Plugin to version 1.3.25, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA Product Sets Plugin (Datafeedr) Fixed in 1.3.25

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116107
  2. 2026-10-27 Alias added: GHSA-5r9h-jfp8-wfxv
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → MEDIUM

References

Patch 1

  • TI-2023-05379 Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2023-26828 WordPress Ads by datafeedr.com Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
  • TI-2025-18364 WordPress WooCommerce Cloak Affiliate Links plugin <= 1.0.35 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences