Is CVE-2026-39434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39434 being exploited in the wild.

How severe is CVE-2026-39434?

High severity, with a CVSS score of 7.2, published 15 June 2026.

Is there a fix for CVE-2026-39434?

A patch was published on 2026-06-15: Patch confirmed available in version 6.6.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39434 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39434?

Check whether you run WebAppick CTX Feed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39434: WebAppick CTX Feed PHP Object Injection in Shop Manager

CVE-2026-39434 · Severity: high · CVSS 7.2 · Published 2026-06-15

The CTX Feed plugin for WordPress, which is used to generate product feeds for marketing channels, contains a security flaw that allows users with 'Shop Manager' privileges to inject malicious code. If exploited, an attacker could gain full control over the website, access sensitive customer data, or disrupt store operations. This vulnerability is particularly dangerous because it can lead to complete site takeover if the right conditions are met.

Technologies: WebAppick CTX Feed. Vendors: WebAppick.

Quick answers

Is CVE-2026-39434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39434 being exploited in the wild.
How severe is CVE-2026-39434?: High severity, with a CVSS score of 7.2, published 15 June 2026.
Which products and versions are affected?: WebAppick CTX Feed <= 6.6.26.
Is there a fix for CVE-2026-39434?: A patch was published on 2026-06-15: Patch confirmed available in version 6.6.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39434 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39434?: Check whether you run WebAppick CTX Feed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A PHP Object Injection vulnerability exists in the WebAppick CTX Feed plugin for WordPress (versions <= 6.6.26) due to insecure deserialization of user-supplied data (CWE-502). The vulnerability is accessible to users with 'Shop Manager' or higher privileges. An attacker can exploit this by submitting specially crafted input that, when processed by the application, allows for the instantiation of arbitrary PHP objects. If a suitable POP (Property-Oriented Programming) chain is present in the environment, this can lead to remote code execution, SQL injection, or file system manipulation. The issue is resolved in version 6.6.27.

Affected products

WebAppick CTX Feed <= 6.6.26

Timeline

2026-02-26: other: Reported by researcher daroo
2026-04-07: advisory: Initial Patchstack advisory published
2026-06-15: disclosed: NVD publication date
2026-06-15: patched: Patch confirmed available in version 6.6.27

References

https://patchstack.com/database/wordpress/plugin/webappick-product-feed-for-woocommerce/vulnerability/wordpress-ctx-feed-plugin-6-6-26-php-object-injection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.