Path traversal in wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support…
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wahid0003 | Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels | up to 6.6.43 | — | No fix listed | CNA |
- Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels Vendorwahid0003 Affected up to 6.6.43 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15095
- 2026-10-03 Alias added: GHSA-mmq2-8hq5-2c6q
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cac5e5ca-34cc-4219-96a3-438c5a1d6a23?source=cve
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Common/Helper.php#L207
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Feed/Feed.php#L113
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Helper/FeedHelper.php#L38
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/MakeFeed.php#L154
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/ManageFeeds.php#L378
- https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/RestController.php#L109
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3627934%40webappick-product-feed-for-woocommerce&new=3627934%40webappick-product-feed-for-woocommerce
More wahid0003 vulnerabilities
- TI-2025-11885 Missing authorization in wahid0003 Product Feed Manager for WooCommerce – CTX Feed… CVSS 3.1HIGH 7.2
- TI-2026-85796 PHP code injection in Product Feed Manager for WooCommerce CVSS 3.1HIGH 7.2
Sources
- CVE-2026-15095 · CVE Program
- CVE-2026-15095 · NVD
- FIRST EPSS
- GHSA-mmq2-8hq5-2c6q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences