CVE-2025-12975
📋 TL;DR
This vulnerability allows authenticated attackers with Shop Manager or higher WordPress roles to install arbitrary plugins via the CTX Feed plugin. This can lead to remote code execution on affected WordPress sites. All WordPress installations using vulnerable versions of the CTX Feed plugin are affected.
💻 Affected Systems
- CTX Feed – WooCommerce Product Feed Manager WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full site compromise through remote code execution, data theft, malware installation, and complete administrative control.
Likely Case
Attackers install malicious plugins to establish backdoors, steal data, or redirect traffic.
If Mitigated
Limited impact if proper role-based access controls and network segmentation are implemented.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once attacker has Shop Manager credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.12
Vendor Advisory: https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'CTX Feed – WooCommerce Product Feed Manager'. 4. Click 'Update Now' if available, or manually update to version 6.6.12 or later.
🔧 Temporary Workarounds
Remove vulnerable plugin
allTemporarily disable or remove the CTX Feed plugin until patched.
wp plugin deactivate webappick-product-feed-for-woocommerce
wp plugin delete webappick-product-feed-for-woocommerce
Restrict user roles
allReview and limit Shop Manager roles to trusted users only.
🧯 If You Can't Patch
- Implement strict access controls for Shop Manager roles and monitor for suspicious plugin installations.
- Deploy web application firewall rules to block plugin installation requests from non-admin users.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → CTX Feed version. If version is 6.6.11 or lower, you are vulnerable.Check Version:
wp plugin get webappick-product-feed-for-woocommerce --field=versionVerify Fix Applied:
Verify plugin version is 6.6.12 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- WordPress logs showing plugin installation by non-admin users
- Unexpected plugin activation events in WordPress activity logs
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with action=woo_feed_plugin_installing
SIEM Query:
source="wordpress.log" AND "plugin installed" AND user_role="shop_manager"🔗 References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417230%40webappick-product-feed-for-woocommerce&new=3417230%40webappick-product-feed-for-woocommerce&sfp_email=&sfph_mail=
- https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4f77f4cd-f4b3-42bc-a1a9-e5df5daa42b7?source=cve
