Product Feed Manager For Woocommerce Ctx Feed Support 220 Shopping Ai Social Channels
Monthly
Authenticated file deletion via directory traversal in the CTX Feed (Product Feed Manager for WooCommerce - 220+ Shopping & Social Channels) WordPress plugin affects all versions up to and including 6.6.43: a user holding shop-manager capability or above can abuse the 'provider' parameter to walk out of the intended feed directory and force an unlink() against files whose extensions match the plugin's own whitelist (csv, xml, tsv, xls, xlsx, json, txt). Exploitation is a deliberate two-call REST sequence - first POST to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal string in wp_options, then a call to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the deletion - so there is no unauthenticated path and no victim interaction beyond the attacker's own privileged session. Our independent assessment rates this a moderate, not high-priority, issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L); the frequently repeated 'leads to RCE' framing is sharply constrained because .php files such as wp-config.php cannot be deleted, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated file deletion via directory traversal in the CTX Feed (Product Feed Manager for WooCommerce - 220+ Shopping & Social Channels) WordPress plugin affects all versions up to and including 6.6.43: a user holding shop-manager capability or above can abuse the 'provider' parameter to walk out of the intended feed directory and force an unlink() against files whose extensions match the plugin's own whitelist (csv, xml, tsv, xls, xlsx, json, txt). Exploitation is a deliberate two-call REST sequence - first POST to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal string in wp_options, then a call to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the deletion - so there is no unauthenticated path and no victim interaction beyond the attacker's own privileged session. Our independent assessment rates this a moderate, not high-priority, issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L); the frequently repeated 'leads to RCE' framing is sharply constrained because .php files such as wp-config.php cannot be deleted, and no public exploit code or confirmed active exploitation was identified at time of analysis.