Content Egg <=11.3.0 Authenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1979)

Vulnerability Overview Vulnerability Name: Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion CVE ID: CVE-2026-1979 CVSS Score: 8.1 (High) Release Date: August 4, 2026 Last Update Date: August 5, 2026 Researchers: Athiwat Tiprasaham (Jitada), Iththodee Araman (Boeing777) Affected Scope Software Type: Plugin Software Name: Content Egg – Affiliate Product Importer & Price Comparison Affected Versions: <= 11.3.0 Fixed Version: 11.4.0 Remediation Remediation Advice: Update to version 11.4.0 or a later patched version Vulnerability Description The Content Egg – Affiliate Product Importer & Price Comparison plugin contains a path traversal vulnerability prior to version 11.3.0, which allows for arbitrary file deletion. This vulnerability arises from insufficient validation of the field, which is passed within the post metadata. The field is only filtered using (which does not strip path traversal sequences), stored in post metadata, and not normalized to a filesystem path before being passed to PHP's function. This allows authenticated attackers with author-level privileges and permissions to delete arbitrary files on the server of the affected website, potentially leading to remote code execution. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Name: Content Egg – Affiliate Product Importer & Price Comparison Software Slug: content-egg Is Patched: Yes Fixed Version: 11.4.0 Recent Vulnerabilities Content Egg <= 7.0.0 - Authenticated (Editor+) PHP Object Injection - CVE ID: CVE-2025-47536 - CVSS Score: 6.6 - Researcher: timonangost - Date: July 30, 2025 Content Egg <= 5.4.0 - Cross-Site Request Forgery - CVE ID: CVE-2022-25952 - CVSS Score: 8.8 - Researcher: Muhammad Daffa - Date: October 31, 2022 Content Egg <= 5.3.0 - Reflected Cross-Site Scripting - CVE ID: CVE-2022-0428 - CVSS Score: 6.1 - Researcher: Krzysztof Zając - Date: June 6, 2022 Summary The Content Egg plugin prior to version 11.3.0 contains a path traversal vulnerability leading to arbitrary file deletion. Users are advised to update to version 11.4.0 or later to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Content Egg <=11.3.0 Authenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1979)

More from this source