---
id: "CVE-2026-113617"
kind: "vulnerability"
aliases: ["CVE-2026-113617"]
title: "WordPress import plugin: path flaw lets subscribers read and delete server files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.0.4-or-later"]
published_at: "2026-10-29T06:17:18+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:54:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113617", "first_seen_at": "2026-10-29T06:53:13+00:00"}]
---

# WordPress import plugin: path flaw lets subscribers read and delete server files

The Automated Import Products to Cart WordPress plugin does not sanitize a user-supplied file path before reading and deleting files. A logged-in user with minimal rights, such as a subscriber, can read arbitrary files, including database credentials, and delete arbitrary files on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `Automated Import Products to Cart` plugin is installed and its version in the WordPress admin under Plugins.
- Compare the installed version with `1.0.4`; anything earlier is affected.

## Fix

- Move the `Automated Import Products to Cart` plugin to `1.0.4` or later.

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113617

## From the sources

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_