Skip to main content
CVE-2026-19778VulnerabilityPublished 09/09/2026

CVE-2026-19778: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in aukejomm WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping

Affects aukejomm WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & ShoppingSource CVE Database V5

CVSS 3.1 base score
6.5Medium
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.3% chance of exploitation in 30 days – higher than 16% of CVEs
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator-level access to trusted users only and monitor for suspicious activity related to the 'feed' parameter. Avoid using affected versions if possible.

Affected software

ProductAffectedFixed in
aukejommWPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & ShoppingAffected
  • >=0 <=2.23.7
Fixed in–

Description

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Weaknesses

References

Track aukejomm WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping with alerts and the API. See plans

Added 09/09/2026 · analysed 09/09/2026 · updated 10/24/2026