What is GHSA-cmrc-7c99-5736?

GHSA-cmrc-7c99-5736 is a security advisory published by GitHub Security Advisories with Critical severity. The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user...

Which CVE IDs does GHSA-cmrc-7c99-5736 cover?

GHSA-cmrc-7c99-5736 covers the following CVE IDs: CVE-2026-113617. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cmrc-7c99-5736?

GHSA-cmrc-7c99-5736 has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

GHSA-cmrc-7c99-5736CriticalCVSS 9.9

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user...

Vendor

GitHub Security Advisories

Published

October 29, 2026

Last Modified

October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-113617 →

📋 Description

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-113617
https://wpscan.com/vulnerability/450a5f9e-3b4c-495d-975f-a24a3d458651
https://github.com/advisories/GHSA-cmrc-7c99-5736