CVE-2026-3499: 
WordPress vulnerability analysis and mitigation

CVE-2026-3499 is a Cross-Site Request Forgery (CSRF) vulnerability in the Product Feed PRO for WooCommerce by AdTribes plugin for WordPress, affecting versions 13.4.6 through 13.5.2.1. The flaw stems from missing or incorrect nonce validation on five AJAX handler functions, allowing unauthenticated attackers to perform unauthorized administrative actions by tricking a site administrator into clicking a malicious link. It was published on April 8, 2026, with a patch available via the WordPress plugin repository. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Wordfence).

The root cause is CWE-352 (Cross-Site Request Forgery), specifically the absence of proper WordPress nonce validation on five AJAX functions: ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed. Because these endpoints do not verify that requests originate from a legitimate, authenticated session, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator (e.g., via a malicious link or page), executes privileged plugin operations without authorization. The attack vector is network-based, requires no privileges, and has low complexity — the only precondition is that a site administrator must be socially engineered into interacting with attacker-controlled content (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to trigger feed migration operations, clear custom-attribute transient caches, rewrite feed file URLs to lowercase, toggle legacy filter and rule settings, and delete duplicated feed posts — all with the privileges of the tricked administrator. These actions can result in data loss, disruption of WooCommerce product feed operations, and corruption of feed configurations, potentially impacting e-commerce revenue and operational continuity. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, reflecting the broad scope of damage possible through a single forged request (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.017% (1st percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Despite the low exploitation probability, the high CVSS score and ease of attack (low complexity, no privileges required) make it a meaningful risk for unpatched WordPress sites running the affected plugin versions.

1. Reconnaissance: Identify WordPress sites running the Product Feed PRO for WooCommerce plugin (versions 13.4.6–13.5.2.1) using passive techniques such as HTTP response headers, plugin enumeration via /wp-content/plugins/woo-product-feed-pro/, or tools like WPScan.
2. Craft a malicious CSRF payload: Create an HTML page or link containing a forged AJAX request targeting one of the vulnerable endpoints (e.g., admin-ajax.php with action=ajax_fix_duplicate_feed or action=ajax_migrate_to_custom_post_type), omitting or providing an invalid nonce value.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or compromised third-party site, inducing them to click the link while authenticated to their WordPress dashboard.
4. Trigger unauthorized action: Upon the administrator's browser loading the forged request, the vulnerable AJAX handler executes without nonce verification, performing the attacker's chosen operation (e.g., deleting feed posts, clearing caches, or toggling legacy settings).
5. Achieve objective: Depending on the targeted function, the attacker achieves data loss, feed disruption, or configuration tampering on the victim's WooCommerce store (GitHub Advisory).

• Logs: WordPress access logs showing unexpected POST requests to wp-admin/admin-ajax.php with action parameters matching ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, or ajax_fix_duplicate_feed from unusual or external IP addresses.
• Application Behavior: Unexpected changes to WooCommerce product feed configurations, feed file URLs suddenly converted to lowercase, disappearance of duplicated feed posts, or toggled legacy filter/rule settings without administrator intent.
• WordPress Logs: Entries in WordPress debug logs or audit logs (if a logging plugin is installed) reflecting AJAX calls to the above functions without a valid nonce, or from sessions not matching expected administrator activity patterns.

The vendor has released a patch addressing the missing nonce validation; administrators should update the Product Feed PRO for WooCommerce plugin to a version newer than 13.5.2.1 immediately via the WordPress plugin repository (changeset 3476067) (GitHub Advisory, WordPress Trac). As a temporary workaround prior to patching, administrators should exercise caution when clicking links from untrusted sources and consider implementing a Web Application Firewall (WAF) with rules to detect and block suspicious AJAX requests targeting the vulnerable endpoints. Security awareness training for site administrators regarding phishing and social engineering is also recommended.

Wordfence included CVE-2026-3499 in its weekly WordPress vulnerability report for April 6–12, 2026, highlighting it as a high-severity CSRF issue (Wordfence). The vulnerability was also picked up by automated security aggregators including RedPacket Security and INCIBE-CERT, reflecting standard community monitoring of WordPress plugin vulnerabilities. No notable independent researcher commentary or significant social media discussion has been identified beyond routine vulnerability tracking.