CVE-2024-7258: High Arbitrary File Deletion in WP Feed Manager

CVE-2024-7258 is a High severity (8.8) missing authorization flaw in the WooCommerce Google Feed Manager plugin for WordPress. Versions up to and including 2.8.0 let an authenticated user with Contributor access delete arbitrary files on the server. Update to a release newer than 2.8.0 and review who holds accounts.

What's affected

The record says the plugin is vulnerable to unauthorized loss of data because of a missing capability check on the wppfm_removeFeedFile function, in all versions up to and including 2.8.0. Authenticated attackers with Contributor level access and above can delete arbitrary files on the server. The record adds that this can easily lead to remote code execution when the right file is deleted, with wp-config.php given as the example.

The NVD configuration data matches: the affected range ends before 2.9.0. That gives 2.9.0 as the first release outside the range, but the record does not name a fixed version directly. The references include a WordPress plugin repository changeset, number 3137475, which is the code change tied to the fix. Check the plugin's changelog and the Wordfence entry linked below before you record 2.9.0 as the fix in your tickets.

The plugin has been renamed over time. The plugin repository path in the references is wp-product-feed-manager, and the current public listing is titled "WPMR Google Feed Manager for WooCommerce", so you may see either name in your admin screen. The vendor in the CPE data is wpmarketingrobot.

The weakness is CWE-862, missing authorization. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. GitHub's advisory database carries the same entry as GHSA-46f4-4mv7-2c6g.

How to check if you're exposed

1. In wp-admin, open Plugins and look for the feed manager plugin. Read the version number.
2. From a shell with WP-CLI, run wp plugin list and look for wp-product-feed-manager, or wp plugin get wp-product-feed-manager --field=version for just the version.
3. Treat any version at or below 2.8.0 as affected.
4. Count user accounts at Contributor level or higher with wp user list --role=contributor. The attacker needs a login, so open registration or many low level accounts raise your exposure.
5. Look for unexpected missing files, especially wp-config.php or plugin files, and for sudden site errors.

What to do now

1. Update the plugin through the WordPress updater to the latest release, and confirm it is newer than 2.8.0.
2. If you cannot update today, deactivate the plugin until you can.
3. Review all accounts with Contributor access or higher and remove the ones you do not recognize. Disable open registration if you do not need it.
4. Make sure you have a recent, tested backup, since the harm here is loss of files.
5. Check your web server and WordPress logs for requests to the plugin's AJAX handlers from low privileged accounts.

Why it matters

WordPress plugins expose actions that run in the admin area. Each action should check what the logged in user is allowed to do. Here, the check was missing on a function that removes feed files, so any logged in user who could reach it was trusted to delete files they chose.

The result is the common shape of a broken access control bug: a feature meant for store managers is open to a much weaker role. Deleting wp-config.php is serious because it can push a site back to its installer, which is how the record connects file deletion to code execution. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source fetched here reports attacks.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub advisory GHSA-46f4-4mv7-2c6g
• Wordfence entry
• WordPress plugin changeset 3137475

Last reviewed: 19 October 2026.