{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/automated-import-products-to-cart--1.0.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-113617"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Automated Import Products to Cart (\u003c 1.0.4)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"","date_modified":"2026-10-29T13:19:09Z","date_published":"2026-10-29T13:19:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wordpress-import-plugin-lfi/","summary":"The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize user-supplied file paths, allowing users with minimal permissions to read or delete arbitrary files on the server.","title":"Automated Import Products to Cart: Arbitrary file read and deletion (CVE-2026-113617)","url":"https://feed.craftedsignal.io/briefs/2026-10-wordpress-import-plugin-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Automated Import Products to Cart (\u003c 1.0.4)","version":"https://jsonfeed.org/version/1.1"}