{"id":"CVE-2026-113617","kind":"vulnerability","aliases":["CVE-2026-113617"],"related":[],"title":"WordPress import plugin: path flaw lets subscribers read and delete server files","description":"The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.","summary":"The Automated Import Products to Cart WordPress plugin does not sanitize a user-supplied file path before reading and deleting files. A logged-in user with minimal rights, such as a subscriber, can read arbitrary files, including database credentials, and delete arbitrary files on the server.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-1.0.4-or-later"],"how_to_check":"- Check whether the `Automated Import Products to Cart` plugin is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version with `1.0.4`; anything earlier is affected.","fix":"- Move the `Automated Import Products to Cart` plugin to `1.0.4` or later.","status":"open","published_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:48+00:00","updated_at":"2026-10-29T06:54:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:54:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move the `Automated Import Products to Cart` plugin to `1.0.4` or later.","reach":"internet","title":"WordPress import plugin: path flaw lets subscribers read and delete server files","impact":"high","summary":"The Automated Import Products to Cart WordPress plugin does not sanitize a user-supplied file path before reading and deleting files. A logged-in user with minimal rights, such as a subscriber, can read arbitrary files, including database credentials, and delete arbitrary files on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads database credentials and deletes arbitrary server files.","analyst_note":"Confirm the affected version range and whether a fixed release is published; the NVD entry gives only 'before 1.0.4'.","how_to_check":"- Check whether the `Automated Import Products to Cart` plugin is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version with `1.0.4`; anything earlier is affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.0.4-or-later"],"who_is_affected":"Sites running the Automated Import Products to Cart WordPress plugin before 1.0.4 are exposed, and the attacker needs only a low-privilege account such as a subscriber. Sites without this plugin, or with it at 1.0.4 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4125,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113617':15A,18A '-2026':14A,17A '1.0.4':81C 'allow':99C 'arbitrari':60B,67B,109C,119C 'autom':25B,73C 'cart':29B,77C 'contain':113C 'credenti':64B,116C 'cve':13A,16A 'databas':63B,115C 'delet':10A,44B,66B,97C,118C 'file':12A,39B,45B,61B,68B,89C,98C,110C,120C 'flaw':5A 'host':22B 'import':2A,26B,74C 'includ':62B,111C 'let':6A 'log':48B 'logged-in':47B 'minim':52B,102C 'one':112C 'packag':19B 'path':4A,40B,90C 'permiss':103C 'plugin':3A,31B,79C 'product':27B,75C 'read':8A,42B,59B,95C,108C 'right':53B 'sanit':34B,84C 'self':21B 'self-host':20B 'server':11A,71B,123C 'subscrib':7A,57B,106C 'suppli':38B,88C 'use':92C 'user':37B,50B,87C,100C 'user-suppli':36B,86C 'wordpress':1A,23B,30B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Automated Import Products to Cart WordPress plugin before 1.0.4 are exposed, and the attacker needs only a low-privilege account such as a subscriber. Sites without this plugin, or with it at 1.0.4 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113617","severity":null,"published_at":"2026-10-29T06:17:18+00:00","modified_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}