Product Feed Manager for WooCommerce <= 8.0.26 — Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter
CVE-2026-87964Published · Updated Action summary
Affected: ≤8.0.26Update to 8.0.27 or newer
All remediation steps- Severity
- High7.2
- CVSS
- 7.2CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWhat does this vector mean?
AV:NAttack vector- Network
AC:LAttack complexity- Low
PR:HPrivileges required- High
UI:NUser interaction- None
S:UScope- Unchanged
C:HConfidentiality- High
I:HIntegrity- High
A:HAvailability- High
- Required access
- Unknown
- Exploit prediction (EPSS)
- 0.9% chance in 30 days61th percentile
- CISA KEV
- Not listed
On this page8
Am I affected?
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels webappick-product-feed-for-woocommerce
- Affected≤ 8.0.26
- Patched in8.0.27
Update to 8.0.27 or newer.
You are affected if you run ≤ 8.0.26. Version 8.0.27 and later are not affected by this issue.
- Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels.
- No admin access? Run a passive check of your site. It reads public files only.
What to do
- Update to version 8.0.27, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
- Watch Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels to get an email when the next vulnerability is published.
Advisory
Source description from Wordfence Intelligence, credited to Wordfence PRISM.
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
Exploits & references
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
More in Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
All 9| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.9 | Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter ≤6.6.43Update to 6.6.44 | CVE-2026-15095 | |
| Medium4.9 | Authenticated (Shop Manager+) Arbitrary File Downloaf ≤6.6.47Update to 6.6.48 | CVE-2026-73383 | |
| High7.2 | Authenticated (Shop Manager+) Remote Code Execution ≤6.6.42Update to 6.6.43 | CVE-2026-66709 | |
| Medium6.6 | Authenticated (Shop Manager+) PHP Object Injection ≤6.6.26Update to 6.6.27 | CVE-2026-39434 | |
| High7.2 | Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation ≤6.6.11Update to 6.6.12 | CVE-2025-12975 |
- Medium4.9Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
≤6.6.43Update to 6.6.44
- Medium4.9Authenticated (Shop Manager+) Arbitrary File Downloaf
≤6.6.47Update to 6.6.48
- High7.2Authenticated (Shop Manager+) Remote Code Execution
≤6.6.42Update to 6.6.43
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
≤6.6.26Update to 6.6.27
- High7.2Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
≤6.6.11Update to 6.6.12
Timeline
CVE published
Severity high, CVSS 7.2
Record last updated
Sources & licenses
Wordfence record- Vulnerability data
- Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
- CVE® identifiers
- Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- EPSS
- Exploit Prediction Scoring System by FIRST.org.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.