CVE-2026-39434

HIGH

WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability

Title source: cna

Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

Core 1

Core References

Vdb Entry vdb-entry

CVSS v3 7.2

EPSS 0.0045

EPSS Percentile 36.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

CWE

CWE-502

Status published

Products (1)

WebAppick/CTX Feed < 6.6.26

Published Jun 15, 2026

Tracked Since Jun 16, 2026