CVE-2025-12975CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
Updated under an hour ago ()
Does this affect you?
It affects wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the woo_feed_plugin_installing() function in all versions up to, and including, 6.6.11. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install arbitrary plugins which can be leveraged to achieve remote code execution.
- CVSS
- 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- Apr 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels wahid0003:product_feed_manager_for_woocommerce_ctx_feed_support_220+_shopping_and_social_channels (from the name) | through 6.6.11 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4f77f4cd-f4b3-42bc-a1a9-e5df5daa42b7?source=cve
- https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417230%40webappick-product-feed-for-woocommerce&new=3417230%40webappick-product-feed-for-woocommerce&sfp_email=&sfph_mail=
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.