CVE-2026-15979: Content Egg Path Traversal Vulnerability

CVE-2026-15979 Overview

CVE-2026-15979 is a path traversal vulnerability in the Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress. The flaw affects all versions up to and including 11.3.0. Authenticated attackers with author-level access or higher can delete arbitrary files on the server hosting the affected site. Deleting critical files such as wp-config.php can force WordPress into a setup state, which may enable remote code execution.

The root cause is insufficient validation of the img_file field stored in the cegg_data post metadata. The value is later concatenated into a filesystem path and passed to PHP's unlink() without normalization.

Critical Impact
Authenticated author-level attackers can delete arbitrary files on the WordPress server, potentially escalating to remote code execution.

Affected Products

Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress
All versions up to and including 11.3.0
WordPress sites permitting author-level or higher user registrations

Discovery Timeline

2026-08-05 - CVE-2026-15979 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15979

Vulnerability Analysis

CVE-2026-15979 is classified as a path traversal vulnerability [CWE-22]. The Content Egg plugin stores per-post data in a cegg_data post meta structure containing an img_file field referencing product image paths. When the plugin later processes this data, the getFullImgPath() helper concatenates the attacker-controlled string with a base directory and hands the result to PHP's unlink() call.

Because the field is only sanitized through wp_strip_all_tags(), sequences such as ../ remain intact. This lets an attacker traverse out of the intended image directory and target files anywhere the PHP process can write. Deleting wp-config.php forces WordPress into its installation workflow, which an attacker can complete to gain administrator access and execute PHP code.

Root Cause

The EggMetabox.php handler accepts the img_file value from post metadata and sanitizes it only with wp_strip_all_tags(), which removes HTML markup but leaves directory traversal characters intact. The value is written directly to post meta without path normalization or an allow-list check against the uploads directory.

Downstream, ImageHelper.php builds the full path via string concatenation in getFullImgPath(). No call to realpath(), no prefix validation, and no basename extraction is performed before the path reaches unlink() inside ContentManager.php.

Attack Vector

An attacker holding an author-level WordPress account authenticates to wp-admin, creates or edits a post using the Content Egg metabox, and submits cegg_data containing an img_file value with traversal sequences pointing to a sensitive file. When the plugin processes the post, the file is deleted. Removing wp-config.php triggers WordPress reinstallation, allowing the attacker to reconfigure the site under attacker-controlled database credentials and achieve code execution.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Changeset for Image Helper for the code paths involved.

Detection Methods for CVE-2026-15979

Indicators of Compromise

Unexpected deletion of files outside the WordPress uploads directory, particularly wp-config.php, .htaccess, or plugin PHP files.
Post meta records containing cegg_data entries where img_file includes ../ or absolute path sequences.
WordPress unexpectedly presenting the installation wizard at /wp-admin/install.php on a previously configured site.
Author-level accounts creating or editing posts with Content Egg metadata immediately before file system anomalies.

Detection Strategies

Inspect the wp_postmeta table for meta_key = 'cegg_data' rows and flag any img_file values containing .., /etc/, or paths outside the wp-content directory.
Enable PHP-level auditing of unlink() calls or use a file integrity monitor to alert on deletions of core WordPress files.
Correlate WordPress audit logs for post edits by author-level users with subsequent file system changes.

Monitoring Recommendations

Monitor web server access logs for POST requests to post.php or admin-ajax.php from author-level accounts containing suspicious img_file parameters.
Alert when wp-config.php or any file under wp-includes/ is deleted or modified outside of scheduled update windows.
Track new author-level user registrations and privilege changes across WordPress sites running Content Egg.

How to Mitigate CVE-2026-15979

Immediate Actions Required

Update the Content Egg plugin to a version newer than 11.3.0 as soon as a fixed release is published by the vendor.
Audit existing WordPress user accounts and remove or downgrade any author-level or higher accounts that are not strictly required.
Restrict WordPress user registration to prevent untrusted accounts from reaching author privileges.
Take a verified backup of wp-config.php, the database, and the wp-content directory before applying changes.

Patch Information

Wordfence has assigned this issue and referenced a code change in the Content Egg trunk via the WordPress Changeset for Image Helper. Site administrators should install the vendor-supplied release that supersedes version 11.3.0 and includes normalization of the img_file path before it reaches unlink().

Workarounds

Deactivate and remove the Content Egg plugin until an updated version is installed.
Apply a web application firewall rule blocking requests where cegg_data[img_file] contains .. or absolute path characters.
Set filesystem permissions so the PHP process cannot delete files outside wp-content/uploads/.
Restrict wp-admin access by IP address or require multi-factor authentication for all author-level accounts.

bash

# Example WAF rule (ModSecurity) blocking traversal in Content Egg img_file
SecRule ARGS_NAMES "@rx cegg_data" \
    "chain,phase:2,deny,status:403,id:1026159790,\
     msg:'CVE-2026-15979 Content Egg path traversal attempt'"
    SecRule ARGS "@rx (\.\./|\.\.\\|^/)" "t:none,t:urlDecodeUni"