The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress contains a path traversal flaw that allows an attacker to control the value of the 'img_file' post meta field. Only fallible sanitization is applied, and the value is later concatenated into a filesystem path and passed directly to PHP's unlink() function. This flaw permits deletion of any file on the server that the web process can reach, and as noted by the vendor, such deletion may enable remote code execution if an attacker deletes a critical file or replaces it with malicious content. The weakness maps to CWE‑22 (Path Traversal).

All WordPress sites running the Content Egg plugin version 11.3.0 or earlier are affected. The plugin is distributed by keywordrush and is commonly installed for affiliate product import and price comparison features. No specific operating system or WordPress version is required beyond the coexistence of the vulnerable plugin.

The vulnerability has a CVSS score of 8.1, indicating high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack requires authenticated access with at least Author privileges; an attacker can craft a post meta entry with a crafted 'img_file' value, causing the plugin to delete arbitrarily specified files on the server. Because the flaw can be triggered by legitimate author-level users, the risk is significant in environments where such roles are widely granted. Once a file is deleted, an attacker might subsequently upload malicious code or exploit other vulnerabilities to achieve remote code execution.