CVE-2026-15979 is a path traversal vulnerability in the Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress, affecting versions up to and including 11.3.0. The issue arises from inadequate validation of the 'img_file' field in the cegg_data post metadata, which only passes through wp_strip_all_tags()—a function that does not remove path traversal sequences. The unvalidated input is stored directly in post meta and later concatenated without normalization into a filesystem path in the getFullImgPath() function before being passed to PHP's unlink() function. Authenticated attackers with author-level privileges or higher can exploit this to delete arbitrary files on the server, potentially enabling remote code execution.

An attacker with author-level access or higher can delete arbitrary files on the affected server, which may disrupt website functionality or enable further attacks such as remote code execution. The vulnerability does not allow direct confidentiality compromise but can cause integrity and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and monitor for suspicious activity related to file deletions. Avoid using affected plugin versions if possible.