CRITICAL 9.9 NVD

CVE-2026-113617

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowi

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

References

https://wpscan.com/vulnerability/450a5f9e-3b4c-495d-975f-a24a3d458651/

Published: 2026-10-29 · Source: NVD · Feed updated: 2026-10-29

This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-10-29 via NVD.

Risk Timeline

CVE Disclosed2026-10-29 · -1 days ago

Remediation Resources

Official Advisory

wpscan.com/vulnerability/450a5f9e-3b4c-495d-975f-a24a3d458651/

vulnfeed aggregates 16756 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.