CVE-2026-0684CWE-863

CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import

Medium · published January 13, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error in the 'cpis_admin_init' function's permission check. This makes it possible for authenticated attackers, with Contributor-level access and above, to import arbitrary products via XML, if the XML file has already been uploaded to the server.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-01-13T13:49Z
EPSS history
Timeline
  • 13 JAN 13:49Z
    CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import
    cvelistv5