CVE-2026-66709
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The CTX Feed plugin versions up to 6.6.42 contain a Remote Code Execution (RCE) vulnerability exploitable by a shop manager. An attacker with shop manager privileges can execute arbitrary code on the server.
Risk Assessment
The vulnerability allows an attacker with shop manager privileges to take over the server, potentially leading to data integrity and availability issues.
Recommendation
It is recommended to update the CTX Feed plugin to a version newer than 6.6.42 to mitigate the vulnerability.
Other vulnerabilities in CTX Feed
See all- CVE-2026-73383Medium
The CTX Feed plugin version 6.6.47 and earlier has an arbitrary file download vulnerability exploitable by users with the Shop manager role. This means a shop manager can download arbitrary files from the server that they should not have access to.
- CVE-2026-39434High
There is a PHP Object Injection vulnerability in the shop manager in CTX Feed versions <= 6.6.26.
Original NVD description (English source)
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.