CVE-2026-15095

Name of the Vulnerable Software and Affected Versions Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels versions prior to 6.6.44

Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can delete arbitrary files on the server. This occurs via the provider parameter and can lead to remote code execution if critical files are removed. The attack requires two sequential REST API calls: first to the '/wp-json/ctxfeed/v1/make feed/save feed config' endpoint to store the traversal payload in wp options, and second to the '/wp-json/ctxfeed/v1/manage feeds/delete feed' endpoint to trigger the unlink() function. Deletion is limited to files with extensions matching a validated whitelist, including csv, xml, tsv, xls, xlsx, json, and txt.

Recommendations Update the plugin to version 6.6.44 or later. As a temporary mitigation, restrict access to the '/wp-json/ctxfeed/v1/make feed/save feed config' and '/wp-json/ctxfeed/v1/manage feeds/delete feed' endpoints for users with shop manager-level access.