Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

WooCommerce Google Feed Manager plugin: Unauthorized data loss and code execution risk

CVE-2024-7258 · published 2 years ago
Summary

The WooCommerce Google Feed Manager plugin for WordPress can be exploited by authorized users with Contributor-level access to delete arbitrary files on the server. This could lead to sensitive data loss and potentially allow an attacker to execute malicious code on the site. To protect your website, update to a version of the plugin that is no longer vulnerable, or consider disabling the plugin if you don't use it.

What to do
  • Update wpmarketingrobot woocommerce_google_feed_manager to version 2.9.0 or later.
Affected software
VendorProductAffected versions
wpmarketingrobot woocommerce_google_feed_manager < 2.9.0
cpe:2.3:a:wpmarketingrobot:woocommerce_google_feed_manager:*:*:*:*:*:wordpress:*:*
Original advisory text
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, a...
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published23 Aug 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-7258 · NVD
Track software like this
Free during beta