Unrated severityNVD Advisory· Published Oct 29, 2026

CVE-2026-113617

Description

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Automated Import Products to Cartllm-create
Range: <1.0.4

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/450a5f9e-3b4c-495d-975f-a24a3d458651/nvd

News mentions

ApostropheCMS: Batch of 25 Vulnerabilities Disclosed, Affecting Core and Modules
Vypr Intelligence · Oct 20, 2026

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000