CVE-2026-87964 · Package
NO FIX YET · SEE WHAT TO DO
The CTX Feed WooCommerce plugin stores a custom feed template and evaluates it with PHP's eval(), so a logged-in user with Shop Manager access can inject PHP code. That gives the attacker remote code execution and control of the whole WordPress site.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the CTX Feed plugin version 8.0.26 or earlier are exposed. Any account with Shop Manager access or higher can reach the vulnerable feed settings, so review who holds that role. Sites without this plugin are not affected.
Not affected if plugin-not-installed, plugin-updated, shop-manager-role-restricted
Who cares ctx-feed, self-hosted, woocommerce, wordpress
wp plugin get <plugin-slug> --field=versionctxfeed_custom2_eval_enabled in the WordPress options table; it defaults to true8.0.26; the fixed version is not stated in the sourcesThe Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wp_unslash() is applied before the value is stored verbatim via update_option(), and during feed generation the Custom2Template::evaluate_return() method passes the stored {(return ...)} template expressions directly to PHP's eval() function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The ctxfeed_custom2_eval_enabled option defaults to true, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.