Is CVE-2026-15095 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15095 being exploited in the wild.

How severe is CVE-2026-15095?

Medium severity, with a CVSS score of 4.9, published 22 September 2026.

Which products and versions are affected?

WebAppick Product Feed Manager for WooCommerce (CTX Feed) up to and including 6.6.43.

Is there a fix for CVE-2026-15095?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15095 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-15095?

Check whether you run WebAppick Product Feed Manager for WooCommerce (CTX Feed) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15095: CTX Feed for WooCommerce directory traversal in product feed deletion

CVE-2026-15095 · Severity: medium · CVSS 4.9 · Published 2026-09-22

The CTX Feed plugin for WooCommerce, which manages product feeds for shopping channels, contains a directory traversal vulnerability allowing authenticated shop managers to delete arbitrary files on the server. Attackers can exploit this via two REST API calls to remove critical files and potentially execute remote code. This affects all versions up to 6.6.43 and requires prior shop manager-level access.

Vendors: WebAppick.

Quick answers

Is CVE-2026-15095 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15095 being exploited in the wild.
How severe is CVE-2026-15095?: Medium severity, with a CVSS score of 4.9, published 22 September 2026.
Which products and versions are affected?: WebAppick Product Feed Manager for WooCommerce (CTX Feed) up to and including 6.6.43.
Is there a fix for CVE-2026-15095?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15095 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-15095?: Check whether you run WebAppick Product Feed Manager for WooCommerce (CTX Feed) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the REST API endpoints /wp-json/ctxfeed/v1/make_feed/save_feed_config and /wp-json/ctxfeed/v1/manage_feeds/delete_feed, where the 'provider' parameter is vulnerable to directory traversal. Attackers with shop manager or higher privileges can inject path traversal sequences to delete arbitrary files via unlink(), though deletion is limited to files with whitelisted extensions (csv, xml, tsv, xls, xlsx, json, txt). The attack requires two sequential API calls to persist and trigger the payload.

Affected products

WebAppick Product Feed Manager for WooCommerce (CTX Feed) up to and including 6.6.43

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.