Executive brief
The CTX Feed plugin for WordPress, which is used to generate product feeds for marketing channels, contains a security flaw that allows users with 'Shop Manager' privileges to inject malicious code. If exploited, an attacker could gain full control over the website, access sensitive customer data, or disrupt store operations. This vulnerability is particularly dangerous because it can lead to complete site takeover if the right conditions are met.
Technical details
A PHP Object Injection vulnerability exists in the WebAppick CTX Feed plugin for WordPress (versions <= 6.6.26) due to insecure deserialization of user-supplied data (CWE-502). The vulnerability is accessible to users with 'Shop Manager' or higher privileges. An attacker can exploit this by submitting specially crafted input that, when processed by the application, allows for the instantiation of arbitrary PHP objects. If a suitable POP (Property-Oriented Programming) chain is present in the environment, this can lead to remote code execution, SQL injection, or file system manipulation. The issue is resolved in version 6.6.27.
Affected products
- WebAppick CTX Feed <= 6.6.26
Timeline
- 2026-02-26: other: Reported by researcher daroo
- 2026-04-07: advisory: Initial Patchstack advisory published
- 2026-06-15: disclosed: NVD publication date
- 2026-06-15: patched: Patch confirmed available in version 6.6.27