WordPress Plugin Vulnerabilities

Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal

Description

The plugin does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

Proof of Concept

Affects Plugins

Plugin icon
auto-import-products-cart-dragdropfile
Fixed in 1.0.4

References

CVE
CVE-2026-113617

Classification

Type
TRAVERSAL
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
9.9 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
450a5f9e-3b4c-495d-975f-a24a3d458651

Timeline

Publicly Published
2026-10-27 (about 2 days ago)
Added
2026-10-27 (about 1 day ago)
Last Updated
2026-10-27 (about 1 day ago)

Other

Published
Title
Published
2023-05-23
Title
WordPress File Upload < 4.19.2 - Admin+ Path Traversal
Published
2022-06-06
Title
Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File Deletion
Published
2026-06-04
Title
Printcart Web to Print Product Designer for WooCommerce < 2.5.2 - Unauthenticated Folder Content Disclosure via Path Traversal
Published
2022-08-09
Title
WPide < 3.0 - Admin+ Arbitrary File Read
Published
2026-08-14
Title
WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect