Ctx Feed Pro
Monthly
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.