CVE-2026-87964 wahid0003 CVE debrief

Who should care

WooCommerce site administrators and defenders should assess exposure and apply patches due to the high severity of this vulnerability. Affected operators must review and validate their exposure, as the vulnerability allows authenticated attackers to inject and execute arbitrary PHP code, potentially leading to remote code execution and site takeover. Platform and security teams should prioritize patching and monitor for suspicious activity. Vulnerability-

Why it matters

CVE-2026-87964 is a high-severity vulnerability in the Product Feed Manager for WooCommerce plugin, allowing authenticated attackers to inject and execute arbitrary PHP code, potentially leading to remote code execution and site takeover.

• Remote code execution and site takeover by authenticated attackers
• Escalation of privileges beyond what the role normally permits
• Potential for arbitrary PHP code injection and execution
• Verification of `ctxfeed_custom2_eval_enabled` option setting

Technical summary

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization.

Defensive priority

High priority for WooCommerce site administrators and defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure by checking if the vulnerable plugin version is in use
• Apply patches or updates to the plugin to fix the vulnerability
• Monitor for suspicious activity and implement compensating controls
• Verify the `ctxfeed_custom2_eval_enabled` option is set to `false`
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by insufficient sanitization of the `feedConfigCustom2` parameter, which allows authenticated attackers to inject and execute arbitrary PHP code. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, making this attack path exploitable out of the box.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.