CTX Feed EUVD-2026-84334

Requires an authenticated WordPress account with shop-manager-level capability or higher (PR:H) on a site running CTX Feed / Product Feed Manager for WooCommerce version 6.6.43 or earlier. Exploitation is a specific two-call sequence against the plugin's REST endpoints: first /wp-json/ctxfeed/v1/make_feed/save_feed_config to store the traversal payload in the 'provider' parameter (persisted to wp_options), then /wp-json/ctxfeed/v1/manage_feeds/delete_feed to invoke unlink(). A hard limiting factor: the deletion target must have an extension in the plugin's whitelist (csv, xml, tsv, xls, xlsx, json, txt), so .php files (including wp-config.php) cannot be deleted, which sharply constrains the claimed RCE escalation path. No unauthenticated access and no user interaction beyond the attacker's own privileged session are required.

This is a moderate, not high-priority, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) is internally inconsistent with the described behavior: the vulnerability is arbitrary file DELETION, which is an integrity/availability impact, yet the vector encodes C:H/I:N/A:N (confidentiality-only). Deletion does not disclose file contents, so the C:H rating appears mislabeled - the real impact is integrity (and some availability), which is why my independent assessment shifts to C:N/I:H/A:L. Two mitigating factors strongly constrain real-world risk: (1) PR:H - the attacker must already hold shop-manager-or-above access, a trusted privileged role; and (2) deletion is restricted to files whose extension matches a whitelist (csv, xml, tsv, xls, xlsx, json, txt), which notably EXCLUDES .php. That whitelist substantially undercuts the 'leads to remote code execution' claim, because the canonical RCE-via-deletion path (removing wp-config.php to force WordPress setup mode) requires deleting a .php file that the whitelist blocks. No EPSS score, KEV listing, POC, or SSVC data was supplied. Exploitation status: no public exploit identified at time of analysis. Overall this reads as a genuine but privilege-gated file-deletion flaw whose advertised RCE ceiling is largely theoretical given the extension constraint.

A user with shop-manager or higher access (or an attacker who has phished/compromised such an account) sends a first authenticated REST call to /wp-json/ctxfeed/v1/make_feed/save_feed_config embedding a directory-traversal payload in the 'provider' parameter, persisting it in wp_options. A second call to /wp-json/ctxfeed/v1/manage_feeds/delete_feed then triggers unlink() against the traversed path, deleting an arbitrary whitelisted-extension file (csv/xml/json/etc.) outside the plugin directory. No public POC is identified, and exploitation requires the high-privilege shop-manager role, limiting the realistic attacker pool.