CVE-2026-73383
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The CTX Feed plugin version 6.6.47 and earlier has an arbitrary file download vulnerability exploitable by users with the Shop manager role. This means a shop manager can download arbitrary files from the server that they should not have access to.
Risk Assessment
The risk is that a user with shop manager privileges can download sensitive files, such as configuration files or data, potentially leading to confidentiality breaches.
Recommendation
It is recommended to update the plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in CTX Feed
See all- CVE-2026-66709Critical
The CTX Feed plugin versions up to 6.6.42 contain a Remote Code Execution (RCE) vulnerability exploitable by a shop manager. An attacker with shop manager privileges can execute arbitrary code on the server.
- CVE-2026-15095Medium
The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 6.6.43 via the 'provider' parameter. An authenticated attacker with shop manager-level access or above can delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls.
- CVE-2026-39434High
There is a PHP Object Injection vulnerability in the shop manager in CTX Feed versions <= 6.6.26.
Original NVD description (English source)
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS