CVE-2026-9331: CWE-862 Missing Authorization in PixelYourSite EDD Product Catalog Feed by PixelYourSite

CVE-2026-9331 is a missing authorization vulnerability (CWE-862) in the EDD Product Catalog Feed by PixelYourSite WordPress plugin. The vulnerability exists because the wpeddpcf_delete_feed function lacks proper capability checks, allowing authenticated attackers with low privileges (subscriber and above) to delete arbitrary option values. This unauthorized modification can lead to denial of service by causing errors on the site. The issue affects all versions up to and including 1.0.2. The CVSS 3.1 base score is 7.1, reflecting high severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

An attacker with subscriber-level access or higher can delete arbitrary option values on the affected WordPress site, potentially causing errors that result in denial of service to legitimate users. There is no confidentiality impact, but integrity is highly impacted due to unauthorized data modification, and availability is affected due to service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access and higher to trusted users only. Monitor for suspicious activity related to option deletions. Avoid granting unnecessary privileges to low-level authenticated users.