CVE-2026-15979: Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passes only through wpstripalltags() (which does not strip path traversal sequences), is stored directly in post meta, and is later concatenated without normalization into a filesystem path in getFullImgPath() before being passed to PHP's unlink(). This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15979?
CVE-2026-15979 has a severity rating of high with a score of 8.1.
How do I fix CVE-2026-15979?
To fix CVE-2026-15979, update the Content Egg plugin to version 11.3.1 or later.
What type of vulnerability is CVE-2026-15979?
CVE-2026-15979 is an Arbitrary File Deletion vulnerability caused by insufficient validation of user input.
Who is affected by CVE-2026-15979?
Users of the Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress on versions up to 11.3.0 are affected by CVE-2026-15979.
What can happen if CVE-2026-15979 is exploited?
Exploitation of CVE-2026-15979 can lead to unauthorized deletion of files on the server.