CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).

• CWE-22

• https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/RestController.php#L109
• https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/MakeFeed.php#L154
• https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/ManageFeeds.php#L378
• https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Common/Helper.php#L207
• https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Feed/Feed.php#L113
• https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Helper/FeedHelper.php#L38
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3627934%40webappick-product-feed-for-woocommerce&new=3627934%40webappick-product-feed-for-woocommerce
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cac5e5ca-34cc-4219-96a3-438c5a1d6a23?source=cve

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15088Vulnerability in Drupal Development Environment. This issue …5.7
• CVE-2026-15089Vulnerability in Drupal Commerce guest registration. This is…9.1
• CVE-2026-1509The Avada (Fusion) Builder plugin for WordPress is vulnerabl…5.4
• CVE-2026-15091IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a…9.3
• CVE-2026-15093IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a…4.3
• CVE-2026-15094The WP Hotel Booking plugin for WordPress is vulnerable to R…6.1
• CVE-2026-15096The Themify Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2026-15097The Themify Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2026-15098The Real3D Flipbook Lite plugin for WordPress is vulnerable …6.4
• CVE-2026-15099The Delicious Recipes plugin for WordPress is vulnerable to …6.4
• CVE-2026-15100The Post Grid Gutenberg Blocks – PostX plugin for WordPress …6.4
• CVE-2026-15101The WPBakery Page Builder plugin for WordPress is vulnerable…6.4