CVE-2026-10026

HighCVSS 7.2/10Last modified Oct 3, 2026

Description

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1002605.3In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password resetCVE-2026-1002615.4In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permissionCVE-2026-1002627.1In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notificatioCVE-2026-1002636.1In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possibleCVE-2026-1002642.7In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server hostCVE-2026-1002656.5In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmationCVE-2026-1002666.5In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted adCVE-2026-1002675.9In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filtersCVE-2026-1002682.7In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templatesCVE-2026-1002694.3In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassedCVE-2026-100279.8IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformCVE-2026-1002702.7In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurat
CVE-2026-10026: High severity, CVSS 7.2 | Vulnix