Description

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-06T10:16:38.110Z",
  "pubdate": "2026-11-06T10:16:38.110Z",
  "executiveSummary": "The Product Feed Manager for WooCommerce – CTX Feed plugin, in versions up to and including 8.0.26, contains a critical PHP Code Injection vulnerability. This flaw allows authenticated attackers with Shop Manager privileges or higher to execute arbitrary PHP code on the underlying server, leading to a complete site takeover.\nThe vulnerability stems from improper input sanitization of the 'feedConfigCustom2' parameter and the dangerous use of the 'eval()' function during template processing. Because the 'ctxfeed_custom2_eval_enabled' option is enabled by default, no additional administrative configuration is required to trigger this vulnerability.\nThe risk implication is severe, as successful exploitation facilitates Remote Code Execution (RCE), enabling attackers to compromise the WordPress environment, access sensitive database information, exfiltrate user data, or deploy malicious backdoors. The vulnerability requires authenticated access, but the minimum privilege level is relatively low, making it a significant threat to WooCommerce-based e-commerce platforms.",
  "technicalDetails": "The vulnerability resides within the way the CTX Feed plugin processes custom configuration parameters. Specifically, the 'feedConfigCustom2' parameter is stored in the WordPress database via the 'update_option()' function after only being processed by 'wp_unslash()'. This lack of sanitization allows for the injection of malicious payloads into the stored options table.\nThe core issue occurs during the feed generation process. The 'Custom2Template::evaluate_return()' method retrieves the unsanitized value from the database. When the plugin encounters '{(return ...)}' template expressions within this stored configuration, it passes the contents directly into PHP's 'eval()' function. Since there is no secondary sanitization or validation performed before this evaluation, the server interprets and executes the string as native PHP code.\nThe attack flow proceeds as follows: An authenticated user with sufficient privileges (Shop Manager or higher) modifies the 'feedConfigCustom2' parameter via the plugin interface. The user injects a payload formatted to be processed by the vulnerable template engine, such as '{(return system(\"id\"));}'. When the plugin engine parses the feed, it invokes 'Custom2Template::evaluate_return()', which executes the injected command with the privileges of the web server process (e.g., www-data).\nBecause the 'ctxfeed_custom2_eval_enabled' option defaults to 'true', the target system is vulnerable immediately upon installation. This bypasses the need for an attacker to escalate privileges to Administrator to enable dangerous settings. The ability to execute arbitrary PHP code leads to full Remote Code Execution (RCE). Post-exploitation impacts include, but are not limited to, the modification of plugin files to maintain persistence, unauthorized access to the underlying operating system, lateral movement within the network, and complete destruction or theft of the WordPress database. This vulnerability effectively collapses the security boundary between the application layer and the server-level execution environment."
}