CVE-2026-39434: WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection vulnerability in the CTX Feed WordPress plugin (versions 6.6.26 and earlier) allows a network-accessible attacker with shop manager-level credentials to inject a malicious serialized PHP object into the application. The flaw is reachable over the network and requires no victim interaction once the attacker is authenticated. Successful exploitation gives the attacker full read, write, and crash capability over the affected environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable endpoint is externally exposed in typical deployments.

• AuthenticationRequired

  A shop manager account (or higher) is required; any credential granting that role is sufficient to trigger the injection.

• Victim interactionNot required

  No user action or social engineering is needed once the attacker holds a valid shop manager session.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition or special memory layout is required to craft a malicious serialized object.

Blast Radius

• Reads stored data including order records, customer PII, and configuration secrets held by the WordPress application.
• Modifies or overwrites persisted database rows and file-system content accessible to the PHP process.
• Crashes the affected service or renders the WordPress site unavailable by corrupting application state during deserialization.
• Depending on the PHP environment, arbitrary code execution through a suitable POP chain may be reachable, giving full server-level access.