Executive brief
The CTX Feed plugin for WooCommerce, which manages product feeds for shopping channels, contains a directory traversal vulnerability allowing authenticated shop managers to delete arbitrary files on the server. Attackers can exploit this via two REST API calls to remove critical files and potentially execute remote code. This affects all versions up to 6.6.43 and requires prior shop manager-level access.
Technical details
The vulnerability exists in the REST API endpoints /wp-json/ctxfeed/v1/make_feed/save_feed_config and /wp-json/ctxfeed/v1/manage_feeds/delete_feed, where the 'provider' parameter is vulnerable to directory traversal. Attackers with shop manager or higher privileges can inject path traversal sequences to delete arbitrary files via unlink(), though deletion is limited to files with whitelisted extensions (csv, xml, tsv, xls, xlsx, json, txt). The attack requires two sequential API calls to persist and trigger the payload.
Affected products
- WebAppick Product Feed Manager for WooCommerce (CTX Feed) up to and including 6.6.43
Timeline
- 2026-09-22: disclosed