VulnSocial

CVE-2026-15095Disclosure

LOWCVSS 4.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-09-30: 1Patch / Workaround · 2026-09-30: 1Technical Details · 2026-09-22: 1Technical Details · 2026-09-30: 109-2209-30
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-221
Disclosure1
2026-09-301
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-15095: Directory Traversal in CTX Feed for WordPress (up to 6.6.43) lets shop managers delete arbitrary files, chaining to RCE. CVSS 4.9. No patch yet. Restrict access and monitor until a fix ships. https://www.valtersit.com/cve/CVE-2026-15095/ #CVE #WordPress #infosec #CTXFeed #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet details CVE-2026-15095, a directory traversal flaw in the CTX Feed WordPress plugin that can lead to RCE, notes no patch is available yet, and advises restricting access and monitoring as a mitigation. It includes a link to further information and lists the CVSS score.

    0000045
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-15095 The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all version… https://www.cve.org/CVERecord?id=CVE-2026-15095

    Post summary

    The tweet discloses that CVE-2026-15095 affects the WordPress 'Product Feed Manager for WooCommerce' plugin, describing it as a directory traversal vulnerability present in all versions.

    00000989
    58.1K followersView on X

Explore more

Back to dashboard