PHP Code Injection in WooCommerce Product Feed Manager by Webappick

CVE-2026-87964

What is CVE-2026-87964?

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to a PHP code injection due to inadequate input sanitization of the feedConfigCustom2 parameter. This vulnerability affects all versions up to and including 8.0.26. Attackers with Shop Manager-level access can exploit this flaw by injecting arbitrary PHP code, leading to a potential site takeover. The plugin uses an insecure method that directly evaluates template expressions through PHP's eval() function without sufficient sanitization, which allows for escalated privileges and full remote code execution. It's crucial for administrators to address this vulnerability promptly to protect their sites.

References