What is the CVSS score of CVE-2026-39434?

CVE-2026-39434 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of CTX Feed are affected by CVE-2026-39434?

The WebAppick Product Feed for WooCommerce WordPress plugin (versions ≤6.6.26) contains a critical object injection vulnerability allowing authenticated Shop Managers to fully compromise affected…

How to fix or mitigate CVE-2026-39434?

Within 24 hours: Identify all WordPress instances running WebAppick Product Feed version 6.6.26 or earlier; audit all Shop Manager account assignments. Within 7 days: Restrict Shop Manager role to essential personnel; implement WAF rules to detect serialized PHP objects in requests; disable plugin if not operationally required. Within 30 days: Contact vendor for patch timeline; migrate to alternative product feed solutions if remediation timeline is unacceptable.

CTX Feed CVE-2026-39434

EUVD-2026-36924 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-7hfg-g6xf-6f7q

PHP Deserialization Ctx Feed

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable wp-admin endpoint (AV:N/AC:L), Shop Manager role required (PR:H), no victim interaction (UI:N), and PHP object injection typically yields full RCE giving high C/I/A.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:35 vuln.today

DescriptionCVE.org

Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

AnalysisAI

PHP Object Injection in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin versions up to and including 6.6.26 allows authenticated users with Shop Manager privileges to trigger unsafe deserialization, leading to full compromise of confidentiality, integrity, and availability on the host site. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36924; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

CTX Feed is a popular WooCommerce product-feed generator plugin developed by WebAppick, used to export product catalogs to Google Shopping, Facebook, and similar marketplaces. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-influenced input into PHP's unserialize() (or an equivalent path), which instantiates arbitrary classes and triggers their magic methods (__wakeup, __destruct, __toString). When combined with POP gadget chains present in WordPress core, WooCommerce, or other loaded plugins, this primitive typically escalates to arbitrary file write or code execution within the PHP process.

RemediationAI

Patch status: Patch available per vendor advisory - upgrade CTX Feed to a version newer than 6.6.26 as identified in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/webappick-product-feed-for-woocommerce/vulnerability/wordpress-ctx-feed-plugin-6-6-26-php-object-injection-vulnerability), and confirm the fixed release from the WordPress.org plugin page before deployment. Until the upgrade is applied, audit and minimize the number of accounts holding the Shop Manager role, enforce strong MFA on all WooCommerce administrative accounts, and consider temporarily deactivating CTX Feed on high-value stores (trade-off: feed exports to Google/Facebook will stop until reactivated). As a defensive layer, deploy a WAF rule (e.g., Patchstack/Wordfence virtual patch) that blocks serialized PHP payloads (strings beginning with O:, a:, C:) on CTX Feed admin endpoints, accepting that overly broad rules may break legitimate admin form submissions and should be tested in monitor mode first.