CVE-2026-15979

Summary

The flaw allows an authenticated attacker with author-level access to delete arbitrary files via path traversal, potentially leading to remote code execution.

Exploitability

Exploitation is moderately difficult as it requires author-level access and knowledge of the specific path traversal payload. Precondition is the attacker must have author-level permissions on the WordPress site.

Blast radius

If exploited, the impact is high as it could lead to remote code execution, allowing full control over the affected server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 11.4.0 or later of the Content Egg – Affiliate Product Importer & Price Comparison plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.