WordPress security changelog
HIGH CVE-2026-15979 Deferred

Content Egg Authors can traverse paths and delete server files

Content Egg through 11.3.0 allows an Author or higher role to place an attacker-controlled img_file path in cegg_data while editing a post. EggMetabox::saveMeta() verifies the normal Content Egg nonce and the user's edit_post or edit_page capability, but ContentManager::dataPresavePrepare() applies only wp_strip_all_tags() before storing the value in _cegg_data_ post metadata. When that entry is later replaced, expires or is deleted, clearData() passes img_file to ImageHelper::getFullImgPath(), which prepends the uploads directory without removing traversal sequences, and unlink() deletes the resolved file. This permits deletion of any server file writable by PHP and may support a separate code-execution chain, although.

CVE / CNA score 8.1 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Content Egg – Affiliate Product Importer & Price Comparison
Plugin slug
content-egg
Affected
<= 11.3.0
Safe version
11.4.0
Published
Aug 05, 2026
Weakness
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

This CVE was published Aug 05, 2026 and is one of 8 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Content Egg to 11.4.0 or later. Review Content Egg metadata submitted by delegated authors, investigate unexpected file loss and restore deleted files from a known-good backup.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directly in post meta, and is later concatenated without normalization into a filesystem path in getFullImgPath() before being passed to PHP's unlink(). This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

Primary and upstream sources