CVE-2026-16611 is an information exposure vulnerability (CWE-200) in the Product Feed PRO for WooCommerce by AdTribes WordPress plugin. Versions prior to 13.5.7 do not enforce authorization on one of their REST API read endpoints, enabling unauthenticated attackers to retrieve sensitive configuration data related to the store's product feeds and category taxonomy. This exposure could aid attackers in understanding the store's internal data structure and feed setup.

An attacker without authentication can disclose confidential configuration information about the store's product feeds, including rules, filters, and field mappings, as well as enumerate the entire product category taxonomy. This information disclosure does not impact data integrity or availability but compromises confidentiality, potentially facilitating further targeted attacks or data harvesting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST API endpoints via web application firewall rules or other access controls to prevent unauthenticated access.