Automated Import Products CVE-2026-113617

Requires the 'Automated Import Products to Cart' plugin installed and active at a version below 1.0.4, and an authenticated account with only minimal privileges (subscriber level per the description and PR:L) - practically meaningful on sites where open user registration is enabled. No elevated role, no victim interaction (UI:N), and no special non-default configuration is described beyond the plugin being present. The limiting factors are therefore the need for any valid authenticated session and the plugin's presence; exploitation targets the user-supplied file-path parameter the plugin passes into file read/delete operations without sanitization.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally consistent with the description: a network-reachable, low-complexity path-traversal flaw (CWE-22) requiring only minimal privileges (PR:L, i.e. a subscriber account) with a scope change justified by reading files outside the application boundary such as database credentials. The vuln.today Decision label is act_now, which aligns with the total technical impact (arbitrary file read AND arbitrary file delete). However, the signals are not uniformly alarming: SSVC records Exploitation as none and Automatable as no, there is no CISA KEV listing, and no EPSS score was supplied, so there is no evidence of active or widespread exploitation at this time. A public PoC reference (WPScan) exists but is not verified as working exploit code. In short, the CVSS and SSVC-impact signals point to a severe, easily reached flaw that warrants prompt patching, while the exploitation-maturity signals (SSVC none, no KEV, PoC unverified) indicate it is not yet confirmed to be exploited in the wild. The PR:L requirement and the WordPress-plugin footprint are the main factors tempering real-world risk relative to the raw 9.9.

An attacker who holds or registers a low-privileged WordPress account (e.g. a subscriber) sends a request to the vulnerable plugin endpoint supplying a crafted, unsanitized file path. The plugin uses that path to read or delete files, letting the attacker retrieve wp-config.php database credentials or delete arbitrary server files. A PoC reference published by WPScan exists but is not verified as working exploit code; the flaw is network-reachable with low attack complexity (AV:N/AC:L).