Description

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-22T09:17:04.333Z",
  "pubdate": "2026-09-22T09:17:04.333Z",
  "executiveSummary": "The Product Feed Manager for WooCommerce (CTX Feed) plugin is susceptible to an authenticated Directory Traversal vulnerability in all versions up to and including 6.6.43. The vulnerability stems from improper input validation within the 'provider' parameter, allowing authenticated attackers with shop manager-level privileges or higher to delete arbitrary files on the underlying filesystem.\nThe security impact is severe, as the ability to delete critical system files can be leveraged to achieve Remote Code Execution (RCE) by destabilizing the environment or disabling security mechanisms. The exploitation process requires two sequential REST API requests to store a malicious payload and trigger the file deletion process. While the deletion function is constrained by a file extension whitelist (csv, xml, tsv, xls, xlsx, json, txt), the scope remains sufficient to compromise the application's integrity and availability. This vulnerability represents a significant risk to the confidentiality, integrity, and availability of the WordPress installation, necessitating immediate attention from administrators.",
  "technicalDetails": "The vulnerability resides within the REST API endpoints provided by the CTX Feed plugin. The root cause is the insecure handling of the 'provider' parameter during feed configuration management, which fails to sanitize input against directory traversal sequences (e.g., ../). This flaw allows the application to resolve paths outside the intended directory structure.\nThe exploitation flow is a two-stage process that leverages the plugin's configuration and management API routes:\n1. Configuration Persistence: An attacker first interacts with the /wp-json/ctxfeed/v1/make_feed/save_feed_config endpoint. By supplying a directory traversal payload in the 'provider' parameter, the attacker instructs the plugin to write a malicious configuration to the wp_options table. This stage essentially 'arms' the plugin by associating the traversal-affected input with a feed configuration object.\n2. Execution via Unlink: The second stage involves sending a request to /wp-json/ctxfeed/v1/manage_feeds/delete_feed. This endpoint invokes the PHP unlink() function on the path defined in the previously saved configuration. Because the path is not restricted to the plugin's upload directory, the attacker can specify the location of critical files on the server.\nAlthough the file deletion is restricted by a hardcoded whitelist (csv, xml, tsv, xls, xlsx, json, txt), this does not negate the impact. In a WordPress context, many critical configuration files, localized data files, or plugin-specific settings use these extensions. Deleting these files can result in application crashes, the removal of essential security configurations, or the facilitation of further exploitation vectors, potentially leading to Remote Code Execution if the deletion removes key logic dependencies or forces the application into an insecure state.\nAuthentication is strictly required, necessitating the attacker to hold at least a 'shop manager' role. The attack is accessible via the standard REST API, making it reachable from any network location where the WordPress instance is exposed. The lack of path canonicalization before file system operations is the primary failure point in the security architecture of the affected REST API endpoints."
}