CVE-2026-15095: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
A directory traversal vulnerability exists in the Product Feed Manager for WooCommerce – CTX Feed plugin up to version 6.6.43. Authenticated users with shop manager-level privileges or higher can exploit this flaw via the 'provider' parameter in the REST API to delete arbitrary files with certain extensions on the server. This deletion can potentially lead to remote code execution if critical files are removed. Exploitation requires two sequential REST API calls to persist and then trigger the deletion payload.
AI Analysis
Technical Summary
CVE-2026-15095 is a CWE-22 directory traversal vulnerability in the Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress, affecting all versions up to and including 6.6.43. The flaw allows authenticated attackers with shop manager-level access or above to delete arbitrary files on the server by abusing the 'provider' parameter through two REST API endpoints: first, saving a traversal payload via /wp-json/ctxfeed/v1/make_feed/save_feed_config, then triggering file deletion via /wp-json/ctxfeed/v1/manage_feeds/delete_feed. The deletion is restricted to files with extensions in a validated whitelist (csv, xml, tsv, xls, xlsx, json, txt). This can lead to remote code execution if critical files are deleted.
Potential Impact
An attacker with shop manager-level privileges can delete arbitrary files with specific extensions on the server, potentially leading to remote code execution if critical files are removed. The vulnerability does not allow direct code execution but creates a path to it through file deletion. The CVSS score is 4.9 (medium severity), reflecting the requirement for high privileges and no user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict shop manager-level access to trusted users only and monitor API usage for suspicious activity related to the affected endpoints. Consider disabling or restricting the vulnerable REST API endpoints if possible.
CVE-2026-15095: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
Description
A directory traversal vulnerability exists in the Product Feed Manager for WooCommerce – CTX Feed plugin up to version 6.6.43. Authenticated users with shop manager-level privileges or higher can exploit this flaw via the 'provider' parameter in the REST API to delete arbitrary files with certain extensions on the server. This deletion can potentially lead to remote code execution if critical files are removed. Exploitation requires two sequential REST API calls to persist and then trigger the deletion payload.
CVSS v3.1
Score 4.9medium
Affected software
wahid0003
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15095 is a CWE-22 directory traversal vulnerability in the Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress, affecting all versions up to and including 6.6.43. The flaw allows authenticated attackers with shop manager-level access or above to delete arbitrary files on the server by abusing the 'provider' parameter through two REST API endpoints: first, saving a traversal payload via /wp-json/ctxfeed/v1/make_feed/save_feed_config, then triggering file deletion via /wp-json/ctxfeed/v1/manage_feeds/delete_feed. The deletion is restricted to files with extensions in a validated whitelist (csv, xml, tsv, xls, xlsx, json, txt). This can lead to remote code execution if critical files are deleted.
Potential Impact
An attacker with shop manager-level privileges can delete arbitrary files with specific extensions on the server, potentially leading to remote code execution if critical files are removed. The vulnerability does not allow direct code execution but creates a path to it through file deletion. The CVSS score is 4.9 (medium severity), reflecting the requirement for high privileges and no user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict shop manager-level access to trusted users only and monitor API usage for suspicious activity related to the affected endpoints. Consider disabling or restricting the vulnerable REST API endpoints if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-08T16:32:23.988Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab291c2f7a7c541064a6ac5
Added to database: 09/22/2026, 14:33:38 UTC
Last enriched: 09/22/2026, 14:48:03 UTC
Last updated: 09/22/2026, 15:00:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.