CVE-2026-87964

Name of the Vulnerable Software and Affected Versions Product Feed Manager for WooCommerce – CTX Feed versions prior to 8.0.27

Description Insufficient sanitization of the feedConfigCustom2 parameter allows authenticated attackers with Shop Manager-level access or higher to perform PHP Code Injection. The issue occurs because the Custom2Template::evaluate return() function passes stored template expressions directly to the PHP eval() function. This can lead to remote code execution and full site takeover. The ctxfeed custom2 eval enabled option is enabled by default, making the system exploitable without additional configuration.

Recommendations Update to version 8.0.27 or later. As a temporary mitigation, disable the ctxfeed custom2 eval enabled option.