Directory Traversal Vulnerability in Product Feed Manager for WooCommerce by WebAppick

CVE-2026-15095

What is CVE-2026-15095?

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress suffers from a directory traversal vulnerability due to improper validation of the 'provider' parameter. This flaw allows authenticated users with shop manager-level access to craft malicious requests that can lead to the deletion of arbitrary files on the server. The exploitation process involves making two REST API calls to manipulate the application's settings and ultimately trigger file deletions. The affected plugin only permits deletions of specific file types, which could potentially result in remote code execution if critical files are removed from the system.

References