EUVD-2026-53341
GHSA-f2px-gwpw-v7cp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Exploitation is network-reachable via the WordPress post editor requiring author-level credentials (PR:L); pure file deletion yields no confidentiality impact (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Content Egg - Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directly in post meta, and is later concatenated without normalization into a filesystem path in getFullImgPath() before being passed to PHP's unlink(). This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
AnalysisAI
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the img_file field within cegg_data post metadata is sanitized only with wp_strip_all_tags() - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside getFullImgPath() (ImageHelper.php:L149) before being passed to PHP's unlink(). Deletion of critical WordPress files such as wp-config.php can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause class. The plugin's image management flow reads the img_file key from the cegg_data post metadata value set via EggMetabox.php:L372. WordPress's wp_strip_all_tags() is the sole sanitization applied at write time; it is designed to remove HTML/PHP tags and is entirely ineffective against POSIX path traversal sequences (../). The unsanitized value is persisted directly in WordPress post meta via ContentManager.php:L161. At deletion time, ContentManager.php:L200 retrieves this value and passes it into getFullImgPath() (application/helpers/ImageHelper.php:L149), where it is concatenated into an absolute filesystem path without any realpath() normalization or directory containment check, before being handed to PHP's native unlink(). The affected CPE is cpe:2.3:a:keywordrush:content_egg_-_affiliate_product_importer_&_price_comparison:*:*:*:*:*:*:*:* covering all versions through 11.3.0. The vulnerable code paths are independently verifiable in the plugin's SVN repository at both the 11.2.0 and 11.3.0 tags.
RemediationAI
An upstream fix has been committed to the Content Egg plugin's SVN trunk, as confirmed by the Trac changeset modifying application/helpers/ImageHelper.php between revisions 3514579 and 3610612; however, the exact version number of a released patched build is not available from the provided data - monitor the WordPress plugin repository for a tagged release beyond 11.3.0 and upgrade as soon as one is published. Until a patched release is confirmed, restrict the WordPress author role exclusively to fully trusted internal users and audit existing author accounts for accounts belonging to external contributors or that may have been compromised. As an additional compensating control, a Web Application Firewall rule blocking requests containing ../ sequences in post metadata fields can reduce exploitation surface, though this introduces maintenance overhead if the WAF must be tuned per-plugin. Installing a file integrity monitoring solution (e.g., Wordfence's file change detection) will alert on unauthorized deletions, reducing attacker dwell time. Disabling the Content Egg plugin entirely is the safest interim measure if affiliate import functionality is non-essential.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today