This vulnerability (CVE-2026-66709) in WebAppick CTX Feed (<=6.6.42) is classified as CWE-94, indicating improper control of code generation leading to code injection. It allows a shop manager with high privileges to remotely execute arbitrary code on the affected system. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation results in remote code execution with high privileges, potentially allowing full system compromise including confidentiality, integrity, and availability impacts. Given the high CVSS score and the nature of the vulnerability, this poses a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager privileges and monitor for suspicious activity related to CTX Feed. Avoid exposing the affected service to untrusted networks where possible.