---
id: "CVE-2026-87964"
page: "https://infrastack.ai/live/CVE-2026-87964"
kind: "vulnerability"
aliases: ["CVE-2026-87964"]
title: "WordPress CTX Feed plugin: Shop Manager can run PHP code on server"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ctx-feed", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated", "shop-manager-role-restricted"]
published_at: "2026-11-06T10:16:38+00:00"
first_seen_at: "2026-11-06T10:40:57+00:00"
updated_at: "2026-11-06T10:41:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87964", "first_seen_at": "2026-11-06T10:40:57+00:00"}]
exploit_sources: []
---

# WordPress CTX Feed plugin: Shop Manager can run PHP code on server

Link for people: https://infrastack.ai/live/CVE-2026-87964 (this .md is for agents)

The CTX Feed WooCommerce plugin stores a custom feed template and evaluates it with PHP's eval(), so a logged-in user with Shop Manager access can inject PHP code. That gives the attacker remote code execution and control of the whole WordPress site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CTX Feed plugin version in the WordPress admin plugin list or `wp plugin get <plugin-slug> --field=version`
- Look for the option `ctxfeed_custom2_eval_enabled` in the WordPress options table; it defaults to `true`
- Review which accounts hold the Shop Manager role

## Fix

- Update the Product Feed Manager for WooCommerce (CTX Feed) plugin to a version later than `8.0.26`; the fixed version is not stated in the sources

## Timeline

- 2026-11-06T10:40:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87964

## From the sources

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_