CVE-2025-12975
Awaiting Analysis Awaiting Analysis - Queue

Unauthorized Plugin Installation in CTX Feed Plugin Enables RCE

Publication date: 2026-02-19

Last updated on: 2026-02-19

Assigner: Wordfence

Description
The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the woo_feed_plugin_installing() function in all versions up to, and including, 6.6.11. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install arbitrary plugins which can be leveraged to achieve remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-19
Last Modified
2026-02-19
Generated
2026-07-06
AI Q&A
2026-02-19
EPSS Evaluated
2026-07-05
NVD
CVE-2025-12975
EUVD
EUVD-2025-207867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ctx_feed woocommerce_product_feed_manager to 6.6.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress has a vulnerability due to a missing capability check in the woo_feed_plugin_installing() function in all versions up to and including 6.6.11.

This flaw allows authenticated attackers who have Shop Manager-level access or higher to install arbitrary plugins without proper authorization.

By exploiting this, attackers can install malicious plugins that may lead to remote code execution on the affected WordPress site.

Impact Analysis

This vulnerability can have serious impacts including unauthorized installation of arbitrary plugins by attackers with Shop Manager-level access.

Such unauthorized plugin installations can be leveraged to execute remote code, potentially allowing attackers to take control of the affected WordPress site.

This can lead to data breaches, site defacement, disruption of services, or further compromise of the hosting environment.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart