CVE-2026-66709

CriticalCVSS 9.1

Published: 06/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Summary

The CTX Feed plugin versions up to 6.6.42 contain a Remote Code Execution (RCE) vulnerability exploitable by a shop manager. An attacker with shop manager privileges can execute arbitrary code on the server.

Risk Assessment

The vulnerability allows an attacker with shop manager privileges to take over the server, potentially leading to data integrity and availability issues.

Recommendation

It is recommended to update the CTX Feed plugin to a version newer than 6.6.42 to mitigate the vulnerability.

Original NVD description (English source)

Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.