CVE-2026-66709
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
The CTX Feed plugin versions up to 6.6.42 contain a Remote Code Execution (RCE) vulnerability exploitable by a shop manager. An attacker with shop manager privileges can execute arbitrary code on the server.
Risk Assessment
The vulnerability allows an attacker with shop manager privileges to take over the server, potentially leading to data integrity and availability issues.
Recommendation
It is recommended to update the CTX Feed plugin to a version newer than 6.6.42 to mitigate the vulnerability.
Other vulnerabilities in CTX Feed
See all- CVE-2026-15095Medium
The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 6.6.43 via the 'provider' parameter. An authenticated attacker with shop manager-level access or above can delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls.
- CVE-2026-73383Medium
The CTX Feed plugin version 6.6.47 and earlier has an arbitrary file download vulnerability exploitable by users with the Shop manager role. This means a shop manager can download arbitrary files from the server that they should not have access to.
- CVE-2026-39434High
There is a PHP Object Injection vulnerability in the shop manager in CTX Feed versions <= 6.6.26.
Original NVD description (English source)
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS