Description

Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-18T15:17:06.403Z",
  "pubdate": "2026-08-18T15:17:06.403Z",
  "executiveSummary": "An arbitrary file download vulnerability exists in the CTX Feed plugin affecting versions <= 6.6.47. The flaw specifically impacts users with the Shop Manager role, allowing authenticated low-privileged attackers to retrieve arbitrary files from the underlying server's filesystem.\nThe vulnerability exposes sensitive system files, configuration files, and application source code, potentially leading to full system compromise or exposure of credentials. Exploitation requires authenticated access with specific role privileges within the WordPress environment.\nThe risk implication is severe due to the potential exposure of sensitive data stored on the web server. Attackers leverage the flaw by interacting with vulnerable backend components exposed by the plugin, bypassing intended access controls on file retrieval operations.\nRemediation requires updating the CTX Feed plugin to a version beyond 6.6.47 where the file download restriction bypass is addressed. Organizations must restrict administrative and shop manager privileges strictly to trusted personnel to mitigate insider and compromised-account threats.",
  "technicalDetails": "The vulnerability resides within the CTX Feed plugin for WordPress, specifically in versions <= 6.6.47. The root cause stems from insufficient input sanitization and improper access control enforcement within file download handling functions provided by the plugin.\nPrivileged users possessing the Shop Manager role can invoke specific functionality intended for feed generation or management that improperly processes file path parameters. Due to a lack of adequate path traversal validation or restriction to designated directories, the application accepts arbitrary file paths supplied via input parameters.\nThe attack flow proceeds as follows: an authenticated attacker with Shop Manager privileges crafts an HTTP request targeting the vulnerable plugin endpoint. The request includes parameter values traversing the directory structure using sequences such as ../ to reference critical system files outside the web root.\nThe vulnerable component processes the request without verifying whether the requested file resides within authorized boundaries. The server reads the target file from the filesystem and streams its contents directly back in the HTTP response body to the attacker.\nAuthentication requirements dictate that the attacker must possess valid credentials for a user account assigned the Shop Manager role. The attack is network-exploitable over HTTP/HTTPS protocols exposed by the WordPress application instance.\nPost-exploitation impact includes the unauthorized retrieval of sensitive files such as wp-config.php, system logs, environment files, or underlying operating system configuration files. This data exposure facilitates further escalation of privileges or lateral movement within the hosting infrastructure."
}