CVE-2026-16611: Product Feed PRO for WooCommerce Information Disclosure - What It Means for Your Business and How to Respond
If your business runs an online store on WordPress with WooCommerce and uses the popular Product Feed PRO for WooCommerce plugin by AdTribes to push products to Google Shopping, Meta, Bing, or other channels, this vulnerability deserves your attention. CVE-2026-16611 allows anyone on the internet to view sensitive details about how you configure product feeds and to map your full product category structure. Retailers, manufacturers, and e-commerce operators across the United States and Canada who rely on this plugin face potential exposure of competitive and operational information. This post explains why the issue matters to business leaders, outlines real-world risks, helps you determine whether you are affected, and provides clear next steps. Technical details appear only in the appendix for IT and security teams.
CVE-2026-16611 was publicly disclosed in mid-August 2026. It affects the Product Feed PRO for WooCommerce plugin by AdTribes in all versions before 13.5.7. The vulnerability was reported by researcher Shivamani Vastrala and coordinated through WPScan. It carries a CVSS score of 7.5 (High) under the common vector that rates confidentiality impact as high. In plain language, the plugin failed to check whether a visitor was allowed to access certain read-only data endpoints. As a result, unauthenticated users could retrieve a store’s feed configuration, including rules, filters, and field mappings, and could list the complete product category taxonomy. The issue was fixed in version 13.5.7. Timeline highlights include initial discovery and private reporting, followed by public disclosure around August 13–15, 2026, and subsequent availability of the patched release.
This vulnerability primarily threatens confidentiality. An outsider can learn how you structure product data for marketing channels, which rules and filters you apply, and the full hierarchy of your product categories, including categories not visible on the public storefront. For an e-commerce business, that information can reveal pricing strategies, inventory focus, promotional logic, and internal taxonomy decisions that competitors or malicious actors could exploit. Operational risk arises if the exposed details help attackers craft more effective social-engineering campaigns or target other weaknesses in your site. Reputation damage can follow if customers or partners learn that configuration data was left accessible. Compliance exposure is real for organizations handling consumer data under frameworks common in the United States and Canada, because unnecessary disclosure of business process information can complicate privacy and security obligations. The risk is highest for stores that actively generate product feeds and keep the plugin installed and reachable from the internet.
Regional specialty retailer: A mid-sized outdoor-goods store in the Midwest relies on Product Feed PRO to populate Google Shopping and Meta catalogs. An unauthenticated party retrieves the feed rules that exclude low-margin items and the complete internal category tree. Competitors gain insight into which product lines receive promotional priority, allowing them to undercut pricing or adjust their own assortments more precisely.
Growing direct-to-consumer brand: A Canadian apparel company uses the plugin to manage multiple country-specific feeds. Disclosure of field mappings and filters reveals how the brand segments inventory by region and size. The information supports more accurate competitive intelligence gathering and could assist in targeted phishing against staff who manage the feeds.
Large multi-brand marketplace seller: An enterprise seller with thousands of SKUs discovers that feed configuration data, including complex exclusion rules, has been accessible. The exposure provides a roadmap of high-value categories and promotional logic that sophisticated actors can use to prioritize further reconnaissance or inventory-scraping efforts.
Small independent shop: A local electronics reseller with limited IT resources leaves an older plugin version running. Enumeration of the full product category taxonomy, including private or seasonal categories, gives outsiders a clear picture of upcoming inventory plans and supplier relationships that the owner preferred to keep internal.
If any of the above apply, treat the site as potentially affected until you confirm the version and apply the fix.
Protecting your online store starts with knowing where the risks sit. IntegSec helps organizations across the United States and Canada identify and close gaps like CVE-2026-16611 before they become business problems. Schedule a penetration test or risk assessment with our team to gain clear visibility into your WordPress and WooCommerce environment and strengthen your overall security posture. Visit https://integsec.com to get started.
TECHNICAL APPENDIX
(For security engineers, penetration testers, and IT professionals only)
The root cause is a missing authorization check on one or more REST read routes registered by the Product Feed PRO for WooCommerce plugin. The affected component is the plugin’s REST API handlers under the adtribes/v1 namespace, specifically routes that return filters, rules, and field mappings for a given feed ID as well as category taxonomy data. The attack vector is network-accessible, unauthenticated HTTP requests to endpoints such as /adtribes/v1/filters-rules/{FEED_ID}. Attack complexity is low, privileges required are none, and no user interaction is needed. The common CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (score 7.5). NVD and related trackers map the issue to CWE-200 (Information Exposure). References include the WPScan entry and the official CVE record.
Version enumeration can be performed by inspecting the plugin directory or using WordPress tools that report installed plugin versions. Scanner signatures should look for the presence of the woo-product-feed-pro plugin below version 13.5.7 and for successful unauthenticated responses from the vulnerable REST routes. Log indicators include repeated GET requests to paths containing rest_route=/adtribes/v1/filters-rules that return HTTP 200 with configuration data rather than 401. Behavioral anomalies appear as external, unauthenticated clients retrieving feed rules or full product category lists. Network exploitation indicators are straightforward HTTP requests that succeed without authentication cookies or nonces and return JSON containing rules, filters, or taxonomy terms.
Official vendor guidance prioritizes the version 13.5.7 patch. Interim network-level restrictions provide temporary protection for environments that cannot patch at once.