CVE-2026-0684 is an authorization bypass vulnerability in the CP Image Store with Slideshow plugin for WordPress. The issue arises from a logic error in the 'cpis_admin_init' function's permission check, allowing authenticated users with Contributor-level privileges or above to import arbitrary products through XML files previously uploaded to the server. This bypass compromises the intended authorization controls of the plugin, potentially enabling unauthorized product imports. The vulnerability affects all versions up to and including 1.1.9 and has a CVSS 3.1 base score of 4.3 (medium severity). No patch or remediation details are currently available.

An attacker with Contributor-level or higher access can bypass authorization controls to import arbitrary products via XML files already present on the server. This could lead to unauthorized modification of product data within the affected WordPress plugin. There is no indication of confidentiality or availability impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for unusual product import activities related to XML files. Avoid uploading untrusted XML files to the server to reduce risk.