What is the CVSS score of EUVD-2026-53912?

EUVD-2026-53912 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of CTX Feed are affected by EUVD-2026-53912?

The CTX Feed plugin for WooCommerce contains a critical remote code execution vulnerability (CVE-2026-66709, CVSS 9.1) affecting versions through 6.6.42, enabling Shop Manager-role users to execute…

How to fix or mitigate EUVD-2026-53912?

Within 24 hours: audit all WooCommerce user accounts to identify Shop Manager role holders, document the current roster, and restrict Shop Manager permissions to essential trusted administrators only. Within 7 days: disable or remove the CTX Feed plugin entirely if not business-critical; if operationally required, isolate the affected WordPress installation to a development environment with no production data access pending vendor patch availability. Within 30 days: monitor the plugin vendor's security advisories for a released patch; upon availability, conduct comprehensive testing in a staging environment before production deployment, and evaluate migration to an alternative, actively-maintained product feed plugin if no security update is released.

CTX Feed EUVD-2026-53912

| CVE-2026-66709 CRITICAL

Code Injection (CWE-94)

2026-08-06 Patchstack

GHSA-3gm5-3v88-c49w

WordPress RCE Code Injection Wordpress Plugin Ctx Feed Webappick

9.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Shop Manager role is required (PR:H) via the network-facing admin UI with no user interaction; code injection yields server RCE beyond the app, so S:C and full C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:37 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

CRITICAL 9.1

DescriptionCVE.org

Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

AnalysisAI

Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 allows a user holding the Shop Manager role to inject and execute arbitrary code (CWE-94) on the underlying server. The CVSS 3.1 score of 9.1 reflects a scope change where WooCommerce-level access translates into full host compromise. No public exploit identified at time of analysis, and no EPSS or KEV data was provided.

Technical ContextAI

CTX Feed is a widely used WooCommerce product-feed generator plugin (vendor CPE cpe:2.3:a:webappick:ctx_feed) that builds merchant feeds for Google Shopping, Facebook, and similar channels. The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning attacker-influenced input reaches a code-evaluation or template-generation sink without adequate sanitization, letting a privileged store operator turn feed configuration into executable PHP on the host. Because the plugin runs inside the WordPress/PHP process, successful injection yields code execution with the privileges of the web server user.

RemediationAI

No vendor-released patch version is identified in the available data; the advisory only confirms that versions <= 6.6.42 are vulnerable, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/webappick-product-feed-for-woocommerce/vulnerability/wordpress-ctx-feed-plugin-6-6-42-remote-code-execution-rce-vulnerability) and the WordPress.org plugin page and upgrade to the first release above 6.6.42 as soon as it is published. As compensating controls until then, restrict the Shop Manager role to a minimal set of fully trusted accounts and enforce strong authentication (2FA) on them, since exploitation depends on that privilege; audit existing shop-manager users for unexpected accounts; and place the wp-admin CTX Feed configuration screens behind IP allow-listing or a WAF rule blocking suspicious feed-template payloads - noting that WAF filtering of code-injection patterns is imperfect and IP restriction can hinder legitimate remote store managers. Consider temporarily deactivating the plugin if feeds are not business-critical, which fully removes the exposure at the cost of feed generation.