Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116107Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization

Medium 5.4

In plain English

A medium-severity missing authorization in Product Sets Plugin from Datafeedr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

Affected products (as reported)

VendorProductVersions
Datafeedr Product Sets Plugin 1.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.7

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C

References