CVE-2026-0684
Authorization Bypass in CP Image Store Plugin Allows Product Import
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | cp_image_store_with_slideshow | to 1.1.9 (inc) |
| unknown_vendor | cp_image_store_with_slideshow | 1.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CP Image Store with Slideshow plugin for WordPress has a logic error in its 'cpis_admin_init' function's permission check. This flaw allows authenticated users with Contributor-level access or higher to bypass authorization and import arbitrary products via XML files, provided the XML file has already been uploaded to the server.
How can this vulnerability impact me? :
This vulnerability can allow attackers with Contributor-level access to import arbitrary products into the WordPress site without proper authorization. This could lead to unauthorized content or data being added to the site, potentially impacting site integrity and trustworthiness.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you should check if the WordPress site is running the CP Image Store with Slideshow plugin version 1.1.9 or earlier. Since the vulnerability involves an authorization bypass in the import functionality, monitoring for suspicious POST requests to the import endpoint with the parameter 'cpis_import' could indicate exploitation attempts. You can use web server logs or tools like Wireshark to look for POST requests containing 'cpis_import'. Additionally, checking the plugin version can be done via WP-CLI with the command: `wp plugin list --field=version --name=cp-image-store`. There are no specific commands provided in the resources for direct detection of exploit attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the CP Image Store with Slideshow plugin to version 1.2.0 or later, where the vulnerability has been fixed by correcting the permission and nonce verification logic. Until the update can be applied, restrict Contributor-level and above users from accessing the import functionality or disable the plugin if possible to prevent exploitation. [2]