CVE-2026-15979 is a path traversal vulnerability (CWE-22) in the Content Egg – Affiliate Product Importer & Price Comparison WordPress plugin. The vulnerability arises because the 'img_file' field in cegg_data post metadata is only sanitized with wp_strip_all_tags(), which does not remove path traversal sequences. This value is stored directly and later concatenated into a file path in the getFullImgPath() function without normalization, then passed to PHP's unlink() function. Authenticated attackers with author-level privileges or higher can exploit this to delete arbitrary files on the server, potentially enabling further attacks such as remote code execution.

An attacker with author-level or higher access can delete arbitrary files on the affected server, which may disrupt website functionality or enable further exploitation such as remote code execution. The vulnerability does not directly disclose data but impacts integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access carefully and monitor for suspicious activity related to file deletions. Avoid granting author-level privileges to untrusted users.