External risk intelligence

Automated Import Products to Cart WordPress Plugin Arbitrary File Read and Delete Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-113617

The vulnerability exists in a WordPress plugin. WordPress sites and their associated plugins are commonly deployed as internet-facing web applications, making this plugin functionality accessible via the public web in standard deployment patterns.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Automated Import Products to Cart WordPress plugin that could allow users with low-level access to read sensitive files, including database credentials, or delete files on the server. This issue arises from improper handling of user-supplied file paths, potentially exposing critical system information and allowing unauthorized file manipulation.

Plugin allows unauthorized file access and deletion.
Matters due to potential sensitive data exposure.
Confirm plugin relevance and exposure status.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user with the subscriber role into uploading a specially crafted file. This could allow them to read sensitive files from the server, such as database credentials, or delete arbitrary files, potentially disrupting the website or leading to further compromise.

Requires authenticated user with subscriber role.
Uploading a specially crafted file.
Arbitrary file read/delete.

Live Threat

Current exploitation, exposure, and threat context

The Automated Import Products to Cart WordPress plugin could allow users with low-level access to read sensitive files from the server, including database credentials. It also enables the deletion of arbitrary files, potentially disrupting site operations. This occurs when the plugin does not properly handle user-provided file paths.

Server files, including credentials.
Users can read and delete arbitrary files.
Compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Automated Import Products to Cart WordPress plugin vulnerability impacts sites using this plugin, likely managed by web application or platform teams. The immediate priority is to identify all instances of this plugin, determine their reachability and business criticality, and locate the accountable system owner to plan remediation based on assessed risk.

Application owners should own the issue.
Verify plugin reachability and business impact.
Plan remediation based on risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Automated Import Products to Cart plugin?

This is an extension for WordPress websites designed to streamline e-commerce workflows by automating how product data is brought into a shopping cart. It serves as a bridge between external data sources and the site's database, often used by site administrators to reduce manual entry. Because it interacts directly with the file system to process or move files, it requires specific permissions that, if mishandled, can create pathways for unauthorized access.

What does CWE-22 mean for CVE-2026-113617?

CWE-22, or Path Traversal, describes a weakness where software fails to properly validate user-supplied file paths. Instead of restricting access to designated folders, the plugin allows a user to input sequences like '..' to navigate outside intended directories. In this CVE, the flaw allows the plugin to treat these inputs as legitimate commands, inadvertently granting an attacker the ability to target sensitive system files or delete site-critical data.

How is this vulnerability triggered?

An attacker must have an account on the WordPress site, even with minimal subscriber-level permissions. By providing a specifically crafted file path to the plugin, they bypass intended security controls to read or remove files. The vulnerability is not triggered by public access alone; it requires this active, authenticated interaction with the plugin's specific file-handling functionality. Standard site browsing or non-interactive page requests do not activate the bug.

Is my site at risk?

According to Halo Surface Signal, this plugin is typically used on internet-facing web applications, which makes the functionality broadly accessible to anyone with a registered account. If your WordPress site is publicly reachable and allows user registrations—or if attackers can gain subscriber access—the risk is elevated. Sites that are strictly internal or do not permit user accounts have a smaller attack surface, but the plugin's inherent flaws remain a concern.

What should I do if I use this plugin?

Your first step is to verify if you are running a version earlier than 1.0.4. Inventory your WordPress installations to see where this plugin is active, then coordinate with your site administrators to restrict access or update the software immediately. Since this flaw allows for the deletion of files and the exposure of database credentials, treat the affected installations as high-priority until you have confirmed the plugin is patched or removed from the environment.

References

wpscan.com/vulnerability/450a5f9e-3b4c-495d-975f-a24a3d458651/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.