What is the CVSS score of CVE-2026-73383?

CVE-2026-73383 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

CTX Feed CVE-2026-73383

Q: Which versions of CTX Feed are affected by CVE-2026-73383?

Arbitrary file download via path traversal in the CTX Feed WordPress plugin (versions <= 6.6.47) exposes server-side files to authenticated shop managers.

EUVD-2026-60798 MEDIUM

Path Traversal (CWE-22)

2026-08-18 Patchstack

GHSA-qr66-8jmv-phv2

WordPress Path Traversal Wordpress Plugin Ctx Feed Webappick

4.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Shop manager authentication (PR:H) is mandatory; exploitation is over the network with no complexity; impact is read-only file disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:36 vuln.today

DescriptionCVE.org

Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

AnalysisAI

Arbitrary file download via path traversal in the CTX Feed WordPress plugin (versions <= 6.6.47) exposes server-side files to authenticated shop managers. The vulnerability (CWE-22) allows a WooCommerce shop manager to craft requests that traverse directory boundaries and retrieve arbitrary files - including sensitive configuration files such as wp-config.php - directly from the web server. No public exploit code or active exploitation has been identified at time of analysis, but the confidentiality impact is complete given successful exploitation.

Technical ContextAI

CTX Feed (by WebAppick, CPE: cpe:2.3:a:webappick:ctx_feed:*:*:*:*:*:*:*:*) is a WooCommerce product feed plugin for WordPress that generates shopping feeds for external marketplaces (Google Shopping, Facebook, etc.). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): user-supplied file path input is not properly sanitized before being used in a file read or download operation. This allows directory traversal sequences (e.g., '../../') to escape the intended download directory and reference arbitrary files on the underlying server filesystem. The vulnerability is scoped to the AJAX or admin-panel request handling code in the plugin, reachable over HTTP from a user holding the WooCommerce 'shop manager' role.

RemediationAI

Update the CTX Feed plugin to a version beyond 6.6.47 immediately - the Patchstack advisory confirms a fix is available; however, the exact patched release version was not independently verified from the provided data, so administrators should consult the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/webappick-product-feed-for-woocommerce/vulnerability/wordpress-ctx-feed-plugin-6-6-46-arbitrary-file-download-vulnerability for the confirmed fixed release. As a compensating control pending upgrade, restrict shop manager account access to trusted individuals only and enforce multi-factor authentication on all WooCommerce admin accounts, since the vulnerability requires a valid shop manager session. Additionally, consider placing sensitive server-side files (wp-config.php) above the web root or using server-level read restrictions to limit the blast radius of any path traversal exploitation.