PT-2026-2636 · WordPress · Cp Image Store With Slideshow

Kazuma Matsumoto · CVE-2026-0684 · Publicado 2026-01-13 · Atualizado 2026-01-13

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CP Image Store with Slideshow plugin for WordPress versions up to and including 1.1.9

Description The CP Image Store with Slideshow plugin for WordPress contains a flaw where an authenticated attacker with Contributor-level access or higher can import arbitrary products via XML, provided the XML file has been previously uploaded to the server. This is due to a logic error in the permission check within the cpis admin init function.

Recommendations Update the CP Image Store with Slideshow plugin to a version later than 1.1.9.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-0684

Produtos afetados

Cp Image Store With Slideshow

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-0684 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/28e48604-2aaf-4e02-9b1e-cebf5f0bfcf7?source=cve · Nota
• https://twitter.com/VulmonFeeds/status/2011119179227635886 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2011082182253822369 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3434716 · Nota
• https://plugins.trac.wordpress.org/browser/cp-image-store/tags/1.1.9/cp-image-store.php#L826 · Nota