CTX Feed WordPress plugin PHP code injection

Shop managers could take over the entire website.

Summary

The Product Feed Manager for WooCommerce (CTX Feed) plugin lets authenticated users with Shop Manager access or higher run arbitrary PHP code on the server. All versions up to and including 8.0.26 are affected.

Affected when

Logged-in account with Shop Manager access or higher
Default settings (ctxfeed_custom2_eval_enabled defaults to true)

What to do

No fixed version is named in the sources. Check that the plugin runs a version newer than 8.0.26 and read the vendor's advisory.

Products and platforms

Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels

CVE IDs

CVE-2026-87964 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 09:38 UTC

First seen 2026-11-09 17:40 UTC