EUVD-2026-53912
GHSA-3gm5-3v88-c49w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Shop Manager role is required (PR:H) via the network-facing admin UI with no user interaction; code injection yields server RCE beyond the app, so S:C and full C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
AnalysisAI
Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 allows a user holding the Shop Manager role to inject and execute arbitrary code (CWE-94) on the underlying server. The CVSS 3.1 score of 9.1 reflects a scope change where WooCommerce-level access translates into full host compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with the WooCommerce Shop Manager role (CVSS PR:H) on a WordPress site running CTX Feed <= 6.6.42; the attacker abuses the plugin's feed-generation/configuration functionality to inject code (CWE-94). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 Critical) signals network-reachable, low-complexity exploitation with full CIA impact and a scope change, but the PR:H requirement is the key mitigating factor: an attacker must already hold the elevated Shop Manager role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A user with the WooCommerce Shop Manager role (a rogue insider or an attacker who phished/compromised such an account) opens the CTX Feed configuration in wp-admin and supplies a crafted feed field or template value that is evaluated as PHP. The plugin executes the injected code, giving the attacker command execution on the web server and a foothold to pivot into the wider host. … |
| Remediation | No vendor-released patch version is identified in the available data; the advisory only confirms that versions <= 6.6.42 are vulnerable, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/webappick-product-feed-for-woocommerce/vulnerability/wordpress-ctx-feed-plugin-6-6-42-remote-code-execution-rce-vulnerability) and the WordPress.org plugin page and upgrade to the first release above 6.6.42 as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WooCommerce user accounts to identify Shop Manager role holders, document the current roster, and restrict Shop Manager permissions to essential trusted administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PHP Object Injection in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin versions up to and includ
Arbitrary file download via path traversal in the CTX Feed WordPress plugin (versions <= 6.6.47) exposes server-side fil
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today