WordPress Automated Import Products to Cart Plugin Arbitrary File Read/Delete Bug

The Automated Import Products to Cart WordPress plugin before version 1.0.4 contains an arbitrary file read and deletion vulnerability.

The plugin fails to sanitize a user-supplied file path before using it to read and delete files.

• Users with minimal permissions, such as subscribers, can exploit this flaw.
• Attackers can read arbitrary files, including files containing database credentials.
• Attackers can also delete arbitrary files on the server.