Answer in brief
CVE-2026-87968 records a Unknown severity vulnerability in Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration. The current sources do not mark it as known exploited. The current feed maps Unknown/Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchantgeneric | >=0 <5.3.2 | 5.3.2 |
Published upstream
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 14, 2026
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Quoted source text, attributed separately from HOL analysis.