EUVD-2026-60798
GHSA-qr66-8jmv-phv2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Shop manager authentication (PR:H) is mandatory; exploitation is over the network with no complexity; impact is read-only file disclosure with no integrity or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
AnalysisAI
Arbitrary file download via path traversal in the CTX Feed WordPress plugin (versions <= 6.6.47) exposes server-side files to authenticated shop managers. The vulnerability (CWE-22) allows a WooCommerce shop manager to craft requests that traverse directory boundaries and retrieve arbitrary files - including sensitive configuration files such as wp-config.php - directly from the web server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WooCommerce shop manager account on the target WordPress installation (CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.9 (Medium) reflects the high privilege requirement (PR:H - shop manager role) that significantly limits the attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WooCommerce shop manager credentials - through phishing, credential reuse, or insider access - sends a crafted HTTP request to the CTX Feed plugin's file download endpoint, embedding a path traversal sequence (e.g., '../../../wp-config.php') as the target filename. The plugin fails to sanitize the input and returns the contents of wp-config.php, exposing the database hostname, credentials, and WordPress secret keys, which the attacker uses to pivot to the database or forge authentication cookies. … |
| Remediation | Update the CTX Feed plugin to a version beyond 6.6.47 immediately - the Patchstack advisory confirms a fix is available; however, the exact patched release version was not independently verified from the provided data, so administrators should consult the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/webappick-product-feed-for-woocommerce/vulnerability/wordpress-ctx-feed-plugin-6-6-46-arbitrary-file-download-vulnerability for the confirmed fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 a
PHP Object Injection in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin versions up to and includ
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today