CVE-2026-113617: Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with minimal permissions, including a WordPress subscriber, can exploit the vulnerable functionality. The attacker does not need administrative or editor-level access.
What access does an attacker need before exploiting it?
The attacker needs an account that can authenticate to the affected WordPress site. The provided information does not indicate that unauthenticated visitors can exploit the issue.
What could an attacker access or damage?
An attacker can use path traversal to read arbitrary server files, including files that may contain database credentials, and delete arbitrary files on the server.
Which plugin versions are affected?
Versions of Automated Import Products to Cart earlier than 1.0.4 are affected. Updating to version 1.0.4 or later addresses the identified vulnerable version range.