PT-2026-2636 · WordPress · Cp Image Store With Slideshow

Kazuma Matsumoto · Published 2026-01-13 · Updated 2026-01-13 · CVE-2026-0684

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CP Image Store with Slideshow plugin for WordPress versions up to and including 1.1.9

Description The CP Image Store with Slideshow plugin for WordPress contains a flaw where an authenticated attacker with Contributor-level access or higher can import arbitrary products via XML, provided the XML file has been previously uploaded to the server. This is due to a logic error in the permission check within the cpis admin init function.

Recommendations Update the CP Image Store with Slideshow plugin to a version later than 1.1.9.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-0684

Affected Products

Cp Image Store With Slideshow

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-0684 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/28e48604-2aaf-4e02-9b1e-cebf5f0bfcf7?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2011119179227635886 · Twitter Post
• https://twitter.com/CVEnew/status/2011082182253822369 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3434716 · Note
• https://plugins.trac.wordpress.org/browser/cp-image-store/tags/1.1.9/cp-image-store.php#L826 · Note