CVE-2026-15979

Name of the Vulnerable Software and Affected Versions Content Egg – Affiliate Product Importer & Price Comparison versions prior to 11.3.1

Description An arbitrary file deletion issue exists due to path traversal, where an attacker can use special character sequences to access and delete files outside the intended directory. The flaw occurs because the img file field within the cegg data post metadata is not properly validated, as the wp strip all tags() function fails to remove path traversal sequences. This value is stored in post meta and subsequently concatenated into a filesystem path within the getFullImgPath() function before being processed by the PHP unlink() function. Authenticated users with author-level access or higher can exploit this to delete arbitrary files on the server, which may lead to remote code execution.

Recommendations Update to a version newer than 11.3.0. As a temporary mitigation, restrict user permissions to prevent users with author-level access from modifying post metadata associated with the img file field.