PT-2026-20596 · WordPress+1 · Ctx Feed – Woocommerce Product Feed Manager+1

German · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-12975

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CTX Feed – WooCommerce Product Feed Manager plugin for WordPress versions through 6.6.11

Description The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress has a flaw that allows unauthorized arbitrary plugin installation. This is due to a missing capability check within the woo feed plugin installing() function. Attackers with Shop Manager-level access or higher can exploit this to install plugins, potentially leading to remote code execution.

Recommendations Update CTX Feed – WooCommerce Product Feed Manager plugin to a version later than 6.6.11.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12975

Affected Products

Ctx Feed – Woocommerce Product Feed Manager

Woocommerce

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12975 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4f77f4cd-f4b3-42bc-a1a9-e5df5daa42b7?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417230%40webappick-product-feed-for-woocommerce&new=3417230%40webappick-product-feed-for-woocommerce&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2025892072331362317 · Twitter Post
• https://wordpress.org/plugins/webappick-product-feed-for-woocommerce · Note