CVE-2026-9331

CVE-2026-9331 is a missing authorization flaw (CWE-862) in the wpeddpcf_delete_feed function of the EDD Product Catalog Feed by PixelYourSite plugin for WordPress, affecting all versions up to and including 1.0.2. Because the function lacks a capability check, any authenticated user - including those with only subscriber-level access - can invoke it over the network and delete arbitrary option values on the target WordPress site. An attacker gains unauthorized modification of site data (high integrity impact) and can cause denial-of-service conditions by deleting an option whose absence breaks the site (low availability impact), with no confidentiality impact per the CVSS score. Any WordPress site running the affected plugin is exposed, and sites that allow open or subscriber-level registration face the greatest risk since a low-privilege account is sufficient. Exploitation is currently quiet: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days (10th percentile).

What to do: Update EDD Product Catalog Feed to the latest patched release (any version after 1.0.2) as soon as it is published; until then, deactivate the plugin or prevent untrusted users from holding subscriber-level accounts, especially on sites with open registration. Site owners should also watch for unexpected site errors or missing option values that could indicate the delete-feed action has been abused.