Paper/Archive/CVE-2026-113617

CVE-2026-113617

Unknown Automated Import Products to Cart — Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal

EPSS 0.2%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (ADP)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 4.9.049 × 201.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

Affected

ProductAffectedFixed inSource

Automated Import Products to Cart< 1.0.41.0.4CNA

Scores by source

CISA ADP9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

exploitwpscan.com/vulnerability/450a5f9e-3b4c-495d-975f-a24a3d458651