Threats tagged 'ghsa-cxg4-c458-g9ph'

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress versions up to and including 8.0.26 contains a PHP code injection vulnerability. This flaw arises from insufficient sanitization of the feedConfigCustom2 parameter, which is passed directly to PHP's eval() function during feed generation. Authenticated users with Shop Manager-level access or higher can exploit this to execute arbitrary PHP code, potentially leading to full remote code execution and site takeover. The vulnerability is exploitable by default as the ctxfeed_custom2_eval_enabled option is true out of the box.