Security Alert Summary
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress (all versions up to and including 6.6.43) is vulnerable to a directory traversal issue via the provider parameter. Authenticated attackers with shop manager-level access or higher can use two specific REST API calls to persist a traversal payload and then trigger deletion of files on the server. Deletion is limited to files with extensions on the plugin’s whitelist (csv, xml, tsv, xls, xlsx, json, txt), and deleting critical files could lead to remote code execution.
CVE Details
- CVE ID: CVE-2026-15095
- Affected component: Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress
- Affected versions: all versions up to and including 6.6.43
- Published: September 22, 2026, 9:17 AM UTC
- Last modified: September 22, 2026, 3:17 PM UTC
- CVSS v3.1: Base score 4.9, severity MEDIUM, vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Authentication / privileges / user interaction: Requires an authenticated user with shop manager-level access or higher. CVSS indicates Privileges Required: HIGH; User Interaction: NONE.
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-22 (Directory Traversal)
Technical Details
This vulnerability is a directory traversal flaw in the plugin’s handling of the provider parameter. Exploitation requires two sequential REST API calls. First, a request to /wp-json/ctxfeed/v1/make_feed/save_feed_config can persist a traversal payload into the wp_options table. Second, a request to /wp-json/ctxfeed/v1/manage_feeds/delete_feed triggers an unlink() call that deletes a file whose path can include the traversal payload.
File deletion is constrained by the plugin’s validated extension whitelist: csv, xml, tsv, xls, xlsx, json, and txt. If an attacker is able to delete files that are critical to the site or contain executable code, this deletion can create conditions that lead to remote code execution. The root cause is insufficient validation or sanitization of the provider parameter before persisting and later using it in a file deletion operation.
How This Could Impact Your Website
In a typical WordPress environment with multiple users, an attacker with shop manager-level credentials (for example, a compromised account belonging to a contractor or an overprivileged internal staff member) could persist a traversal payload and then trigger deletion of files matching the plugin’s allowed extensions. Deleted files might include feed exports or other files that contain configuration or data. Because the confidentiality impact is rated HIGH, sensitive information (such as exported data or files that contain user details) could be exposed or removed.
Practical consequences include loss of exported data, exposure of information stored in deleted files, and an increased risk of targeted phishing or social engineering if attacker-controlled deletions reveal contact details. While the vulnerability does not by itself guarantee full site takeover, deleting critical files can create conditions that enable remote code execution in some environments.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially shop manager and contributor roles.
- Enforce strong passwords and enable two-factor authentication for editors, administrators, and shop managers.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual REST API requests or unexpected file deletions.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/RestController.php#L109
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/MakeFeed.php#L154
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/ManageFeeds.php#L378
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Common/Helper.php#L207
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Feed/Feed.php#L113
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Helper/FeedHelper.php#L38
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3627934%40webappick-product-feed-for-woocommerce&new=3627934%40webappick-product-feed-for-woocommerce
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cac5e5ca-34cc-4219-96a3-438c5a1d6a23?source=cve
