Arbitrary File Deletion Vulnerability in Content Egg Plugin for WordPress

CVE-2026-15979

What is CVE-2026-15979?

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress contains a vulnerability that allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. This issue arises from inadequate validation of the 'img_file' field in the cegg_data post metadata, which permits path traversal sequences. The vulnerability stems from the use of wp_strip_all_tags(), which does not sufficiently sanitize the path input, allowing for potential exploitation through the getFullImgPath() function before calling PHP's unlink(). This could lead to significant security risks, including remote code execution.

References