Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-15095— Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

Quick assessment

Affected
wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WooCommerce 产品源管理器 – CTX Feed – 支持 220+ 个购物及社交渠道的 WordPress 插件，在 6.6.43 及之前所有版本中均存在目录遍历（Directory Traversal）漏洞，漏洞存在于 参数中。 该漏洞允许拥有商店经理（shop manager）权限或更高权限的已认证攻击者删除服务器上的任意文件。若关键文件被删除，可能导致远程代码执行（RCE）。 利用该漏洞需要依次发起两个 REST API 请求： 1. 首先向 发送请求，将遍历 payload 持久化存储到 表中；

CVSS 4.9 · Medium EPSS 1.07% · P65

Affected Version Matrix 1

VendorProduct Version RangeStatus
wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels ≤ 6.6.43 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15095

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels 0 ~ 6.6.43 -

II. Public POCs for CVE-2026-15095

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15095

请登录查看更多情报信息。

Other References for CVE-2026-15095 (6)

IV. Related Vulnerabilities

Same vendor: wahid0003
Same weakness: CWE-22

V. Comments for CVE-2026-15095

No comments yet

Leave a comment