The Automated Import Products to Cart WordPress plugin does not sanitize a user‑supplied file path before using it to read and delete files. This omission allows users with minimal permissions, such as subscribers, to read arbitrary files on the server, including files containing database credentials, and to delete arbitrary files. The vulnerability exposes confidentiality, integrity, and availability by enabling attackers to obtain sensitive data or cause data loss through path traversal.

WordPress sites that have the Automated Import Products to Cart plugin installed in any version prior to 1.0.4 are affected. Specific vendor information is not publicly documented, but the plug‑in can be identified by its name in the WordPress plugin repository. Any site running an unsupported version of this plug‑in is at risk.

Attackers only need subscriber‑level access and must supply a crafted request containing a path that traverses the filesystem; no elevated privileges or network exploits are required because the attack vector is available through normal user interactions. The EPSS score for this vulnerability is not available and it is not listed in CISA KEV, indicating that no active exploits have been reported. While a publicly disclosed CVSS score is missing, the potential to read database credentials or delete files implies a high impact on confidentiality, integrity, and availability.