CTX Feed Pro EUVD-2026-91171

Requires a valid WordPress account with Administrator-level privileges (or higher) and access to the CTX Feed Pro plugin's 'Feed Config' field, whose value is passed directly to PHP's eval(). The plugin (CTX Feed Pro / WooCommerce Product Feed Pro by Webappick) must be installed and active at version 7.6.12 or earlier. The decisive limiting factor is the Administrator prerequisite (PR:H): this is not exploitable by anonymous or low-privileged users, which sharply narrows realistic attackers to those who already hold or have stolen admin credentials, or to multi-admin environments where a lower-trust admin should not have code-execution rights. No user interaction beyond the attacker's own save action is needed (UI:N), and no non-default configuration is required.

This is a real but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) shows network-reachable, low-complexity exploitation with full confidentiality/integrity/availability impact, but critically requires PR:H - Administrator-level access to WordPress. That high privilege requirement is the dominant mitigating factor and is why the score is capped at High rather than Critical: an attacker already holding admin can typically do significant damage through legitimate plugin/theme editing, so this flaw's marginal escalation is to arbitrary PHP RCE at the web-server process level. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no signal of active or widespread exploitation (status: no public exploit identified at time of analysis). The CVSS attack vector (AV:N) and the description are consistent - exploitation is through an authenticated web interface. The main value here is for post-compromise persistence/code execution or for abuse of a rogue/secondary admin account, not for mass unauthenticated exploitation. Missing signals: EPSS and POC status are absent and should be treated as unknown rather than negative.

An attacker who has obtained WordPress Administrator credentials (via phishing, credential reuse, or a separate privilege escalation) navigates to the CTX Feed Pro 'Feed Config' field and injects PHP code, which the plugin passes directly to eval(), yielding arbitrary PHP execution in the web-server context. No public exploit code is identified at time of analysis, and because the CVSS complexity is low (AC:L) and no user interaction is needed, the action succeeds immediately once admin access is held. This effectively converts admin-panel access into full server-side code execution.