{"id":"CVE-2026-87964","kind":"vulnerability","aliases":["CVE-2026-87964"],"related":[],"title":"WordPress CTX Feed plugin: Shop Manager can run PHP code on server","description":"The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.","summary":"The CTX Feed WooCommerce plugin stores a custom feed template and evaluates it with PHP's eval(), so a logged-in user with Shop Manager access can inject PHP code. That gives the attacker remote code execution and control of the whole WordPress site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ctx-feed","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated","shop-manager-role-restricted"],"how_to_check":"- Check the installed CTX Feed plugin version in the WordPress admin plugin list or `wp plugin get <plugin-slug> --field=version`\n- Look for the option `ctxfeed_custom2_eval_enabled` in the WordPress options table; it defaults to `true`\n- Review which accounts hold the Shop Manager role","fix":"- Update the Product Feed Manager for WooCommerce (CTX Feed) plugin to a version later than `8.0.26`; the fixed version is not stated in the sources","status":"open","published_at":"2026-11-06T10:16:38+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","triaged_at":"2026-11-06T10:41:12+00:00","updated_at":"2026-11-06T10:41:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T10:41:12Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Product Feed Manager for WooCommerce (CTX Feed) plugin to a version later than `8.0.26`; the fixed version is not stated in the sources","reach":"internet","title":"WordPress CTX Feed plugin: Shop Manager can run PHP code on server","impact":"high","summary":"The CTX Feed WooCommerce plugin stores a custom feed template and evaluates it with PHP's eval(), so a logged-in user with Shop Manager access can inject PHP code. That gives the attacker remote code execution and control of the whole WordPress site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ctx-feed","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs arbitrary PHP code and takes over the site","analyst_note":"Confirm the fixed plugin version from the vendor or WordPress.org changelog; NVD gives none here.","how_to_check":"- Check the installed CTX Feed plugin version in the WordPress admin plugin list or `wp plugin get <plugin-slug> --field=version`\n- Look for the option `ctxfeed_custom2_eval_enabled` in the WordPress options table; it defaults to `true`\n- Review which accounts hold the Shop Manager role","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated","shop-manager-role-restricted"],"who_is_affected":"Sites running the CTX Feed plugin version 8.0.26 or earlier are exposed. Any account with Shop Manager access or higher can reach the vulnerable feed settings, so review who holds that role. Sites without this plugin are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000773,"input_tokens":4479,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87964':15A,18A '220':82C '8.0.26':103C 'access':54B,167C 'addit':208C 'administr':209C 'ai':84C 'appli':118C 'arbitrari':174C 'attack':62B,161C,215C 'authent':160C 'beyond':183C 'box':223C 'channel':86C 'code':10A,58B,64B,94C,152C,176C,192C 'code-level':151C 'configur':210C 'control':67B 'ctx':2A,20B,29B,79C 'ctx-feed':19B 'ctxfeed':198C 'custom':35B 'custom2':199C 'custom2template':133C 'cve':13A,16A 'default':203C 'direct':143C 'due':106C 'enabl':201C 'escal':180C 'eval':44B,147C,200C 'evalu':39B,134C 'execut':65B,173C,193C 'exploit':219C 'express':142C 'feed':3A,21B,30B,36B,75C,80C,130C 'feedconfigcustom2':112C 'full':190C 'function':148C 'generat':131C 'give':60B 'host':25B 'includ':102C 'inject':56B,95C,171C 'insuffici':108C 'level':153C,166C 'log':48B 'logged-in':47B 'make':156C 'manag':6A,53B,76C,165C 'manager-level':164C 'mean':206C 'method':136C 'normal':187C 'option':127C,202C 'packag':22B 'paramet':113C 'pass':137C 'path':216C 'permit':188C 'php':9A,42B,57B,93C,145C,175C 'plugin':4A,32B,87C 'possibl':158C 'privileg':182C 'product':74C 'remot':63B,191C 'requir':212C 'return':135C,140C 'role':186C 'run':8A 'sanit':109C,154C 'self':24B 'self-host':23B 'server':12A,179C 'shop':5A,52B,83C,163C 'site':72B,195C 'social':85C 'store':33B,123C,139C 'support':81C 'takeov':196C 'templat':37B,141C 'true':205C 'unslash':116C 'updat':126C 'user':50B 'valu':121C 'verbatim':124C 'version':98C 'via':125C 'vulner':91C 'whole':70B 'without':149C 'woocommerc':26B,31B,78C 'wordpress':1A,27B,71B,89C 'wp':115C","nicknames":[],"mitigations":[],"who_affected":"Sites running the CTX Feed plugin version 8.0.26 or earlier are exposed. Any account with Shop Manager access or higher can reach the vulnerable feed settings, so review who holds that role. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ctxfeed","high","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-2026':14A,17A '-87964':15A,18A 'code':10A 'ctx':2A 'cve':13A,16A 'feed':3A 'manag':6A 'php':9A 'plugin':4A 'run':8A 'server':12A 'shop':5A 'wordpress':1A","search_b":"'access':54B 'attack':62B 'code':58B,64B 'control':67B 'ctx':20B,29B 'ctx-feed':19B 'custom':35B 'eval':44B 'evalu':39B 'execut':65B 'feed':21B,30B,36B 'give':60B 'host':25B 'inject':56B 'log':48B 'logged-in':47B 'manag':53B 'packag':22B 'php':42B,57B 'plugin':32B 'remot':63B 'self':24B 'self-host':23B 'shop':52B 'site':72B 'store':33B 'templat':37B 'user':50B 'whole':70B 'woocommerc':26B,31B 'wordpress':27B,71B","search_c":"'220':82C '8.0.26':103C 'access':167C 'addit':208C 'administr':209C 'ai':84C 'appli':118C 'arbitrari':174C 'attack':161C,215C 'authent':160C 'beyond':183C 'box':223C 'channel':86C 'code':94C,152C,176C,192C 'code-level':151C 'configur':210C 'ctx':79C 'ctxfeed':198C 'custom2':199C 'custom2template':133C 'default':203C 'direct':143C 'due':106C 'enabl':201C 'escal':180C 'eval':147C,200C 'evalu':134C 'execut':173C,193C 'exploit':219C 'express':142C 'feed':75C,80C,130C 'feedconfigcustom2':112C 'full':190C 'function':148C 'generat':131C 'includ':102C 'inject':95C,171C 'insuffici':108C 'level':153C,166C 'make':156C 'manag':76C,165C 'manager-level':164C 'mean':206C 'method':136C 'normal':187C 'option':127C,202C 'paramet':113C 'pass':137C 'path':216C 'permit':188C 'php':93C,145C,175C 'plugin':87C 'possibl':158C 'privileg':182C 'product':74C 'remot':191C 'requir':212C 'return':135C,140C 'role':186C 'sanit':109C,154C 'server':179C 'shop':83C,163C 'site':195C 'social':85C 'store':123C,139C 'support':81C 'takeov':196C 'templat':141C 'true':205C 'unslash':116C 'updat':126C 'valu':121C 'verbatim':124C 'version':98C 'via':125C 'vulner':91C 'without':149C 'woocommerc':78C 'wordpress':89C 'wp':115C","first_public_at":"2026-11-06T10:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87964","severity":null,"published_at":"2026-11-06T10:16:38+00:00","modified_at":"2026-11-06T10:16:38+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","fetched_at":"2026-11-06T10:40:57+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}