The CTX Feed plugin, a WordPress extension from WebAppick, contains a server-side flaw that allows an attacker to execute arbitrary code on the hosting server. The weakness is identified as CWE-94, code execution via unsanitized input. Successful exploitation would give the attacker full control over the affected WordPress installation, compromising confidentiality, integrity, and availability of that site and any underlying infrastructure. WordPress sites that have the WebAppick CTX Feed plugin installed at version 6.6.42 or earlier are vulnerable. The plugin may be part of a larger e‑commerce stack, but only the CTX Feed component is implicated. The vulnerability is assigned a CVSS score of 9.1, indicating critical severity, though an EPSS score is not available, so the likelihood of exploitation in the field is currently unknown. The issue is not listed in the CISA KEV catalog. As a web‑surface vulnerability, the most likely attack vector is a remote attacker issuing crafted HTTP requests that trigger the plugin’s vulnerable code path, potentially by manipulating parameters in the shop manager interface.

WordPress sites using the WebAppick CTX Feed plugin version 6.6.42 or older are affected. The vulnerability pertains solely to the CTX Feed component of the plugin.

With a CVSS score of 9.1, this flaw carries critical risk. EPSS data is not provided, leaving the real-world exploitation probability uncertain. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would target the plugin via HTTP requests to the shop manager endpoint or other exposed interfaces that invoke the vulnerable code path, allowing arbitrary code execution on the web server.