CVE-2026-103349: Deserialization of Untrusted Data in Rymera Web Co Product Feed PRO for WooCommerce

This vulnerability in Product Feed PRO for WooCommerce allows an attacker with high privileges to exploit deserialization of untrusted data, resulting in object injection. The affected versions include all releases prior to 13.5.8. The CVSS 3.1 vector indicates that the attack can be performed remotely over the network, requires low attack complexity, and no user interaction, but does require high privileges. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system.

An attacker with high privileges can exploit this vulnerability remotely to perform object injection via deserialization of untrusted data. This can lead to complete compromise of the system's confidentiality, integrity, and availability, potentially allowing arbitrary code execution or other malicious actions.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to high privilege accounts and monitor for suspicious activity related to the plugin.