Description
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
Published: 2026-11-06
Score: 7.2 High
EPSS: 1.4% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The Product Feed Manager for WooCommerce – CTX Feed – Support plugin contains a flaw that permits authenticated users with at least Shop Manager privileges to store malicious PHP code in the feedConfigCustom2 parameter. During feed generation, the stored expression is passed directly to PHP's eval() function without sanitization, allowing execution of arbitrary code on the server. This grants attackers remote code execution capabilities and the ability to take over the site, far exceeding the normal permissions of their role.

Affected Systems

ulnerable versions include all releases up to and including 8.0.26 of the Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin, developed by wahid0003. Users of these releases are at risk if their WordPress installation permits Shop Manager or higher level accounts to adjust feed templates.

Risk and Exploitability

The flaw carries a CVSS score of 7.2, indicating high severity, and an EPSS score of 1%, indicating a very low but non-zero likelihood of exploitation. The vulnerability is not yet listed in CISA’s KEV catalog. Successful exploitation requires an authenticated user with Shop Manager or above access; attackers can inject code through the feedConfigCustom2 setting, triggering eval() during feed generation. Because the option ctxfeed_custom2_eval_enabled defaults to true, no additional configuration changes by an administrator are needed to enable this attack path.

Generated by OpenCVE AI on November 6, 2026 at 14:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the plugin to the latest version (≥8.0.27) where the eval-based vulnerability has been removed.
  • Restrict or delete Shop Manager and higher roles from modifying feed templates or accessing the feed configuration interface until a patch is applied.
  • Monitor the wp_options table for unexpected entries containing {(return ...)} patterns and review server logs for unusual eval executions; consider disabling the ctxfeed_custom2_eval_enabled option if possible.

Generated by OpenCVE AI on November 6, 2026 at 14:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.15/V8/API/FeedEndpoint.php#L1893 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.15/V8/API/FeedEndpoint.php#L456 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.15/V8/API/RestController.php#L46 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.15/V8/Template/Custom2Template.php#L153 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.15/V8/Template/Custom2Template.php#L623 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.17/V8/API/FeedEndpoint.php#L1893 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.17/V8/API/FeedEndpoint.php#L456 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.17/V8/API/RestController.php#L46 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.17/V8/Template/Custom2Template.php#L153 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/8.0.17/V8/Template/Custom2Template.php#L623 cve-icon cve-icon
https://plugins.trac.wordpress.org/changeset?reponame=&old=3711354%40webappick-product-feed-for-woocommerce&new=3711354%40webappick-product-feed-for-woocommerce cve-icon cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/5f900cd9-90f8-46e3-942e-de20a288a1a6?source=cve cve-icon cve-icon
History

Fri, 06 Nov 2026 09:45:00 +0000

Type Values Removed Values Added
Description The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
Title Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-11-06T09:38:13.070Z

Reserved: 2026-09-09T17:45:23.464Z

Link: CVE-2026-87964

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-06T10:16:38.110

Modified: 2026-11-06T10:16:38.277

Link: CVE-2026-87964

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T15:00:07Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')