Threats tagged 'ghsa-f2px-gwpw-v7cp'

The Content Egg – Affiliate Product Importer & Price Comparison WordPress plugin up to version 11.3.0 contains a path traversal vulnerability that allows authenticated users with author-level access or higher to delete arbitrary files on the server. This occurs because the plugin insufficiently validates the 'img_file' field, enabling crafted input to bypass filtering and cause deletion via PHP's unlink() function. This vulnerability can lead to denial of service or potentially remote code execution if critical files are deleted.