Live › vulnerability › CVE-2026-113617
The Automated Import Products to Cart WordPress plugin does not sanitize a user-supplied file path before reading and deleting files. A logged-in user with minimal rights, such as a subscriber, can read arbitrary files, including database credentials, and delete arbitrary files on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Automated Import Products to Cart WordPress plugin before 1.0.4 are exposed, and the attacker needs only a low-privilege account such as a subscriber. Sites without this plugin, or with it at 1.0.4 or later, are not affected.
No product ranges from the sources yet.
Automated Import Products to Cart plugin is installed and its version in the WordPress admin under Plugins.1.0.4; anything earlier is affected.Automated Import Products to Cart plugin to 1.0.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-113617")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.