CVE-2026-0684: 
WordPress vulnerability analysis and mitigation

CVE-2026-0684 is an authorization bypass vulnerability in the CP Image Store with Slideshow plugin for WordPress, affecting all versions up to and including 1.1.9. The flaw stems from a logic error in the cpis_admin_init function's permission check, allowing authenticated attackers with Contributor-level access or higher to import arbitrary products via XML. It was published on January 13, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence).

The root cause is classified as CWE-863 (Incorrect Authorization), specifically a logic error in the cpis_admin_init function that fails to properly validate whether the requesting user has sufficient privileges to perform product import operations. An authenticated attacker with at least Contributor-level access can exploit this by triggering the XML import functionality with a pre-uploaded XML file on the server, bypassing the intended administrative permission gate. The vulnerable code path is visible in the plugin source at line 826 of cp-image-store.php in version 1.1.9, and the fix is documented in changeset 3434716 (WordPress Trac, WordPress Changeset).

Successful exploitation allows authenticated low-privileged users (Contributor and above) to import arbitrary product data via XML, resulting in unauthorized modification of site content and data integrity compromise. The impact is limited to integrity (low), with no direct confidentiality or availability impact per the CVSS assessment. In a multi-author WordPress environment, this could allow a malicious contributor to manipulate product listings or inject unwanted content into the store (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which significantly limits the attacker pool (Wordfence).

1. Reconnaissance: Identify WordPress sites running the CP Image Store with Slideshow plugin at version 1.1.9 or earlier, using tools like WPScan or manual inspection of plugin metadata.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Upload XML file: Use any available file upload mechanism on the site to place a crafted XML product import file on the server (the exploit requires the file to already be present on the server).
4. Trigger unauthorized import: Send a crafted request to the cpis_admin_init function endpoint that invokes the XML import functionality, bypassing the flawed permission check due to the logic error.
5. Achieve objective: The arbitrary XML product data is imported into the store, allowing the attacker to modify product listings or inject malicious content (WordPress Trac, Wordfence).

• Logs: WordPress access logs showing POST requests to admin-ajax.php or admin endpoints invoking cpis_admin_init actions from Contributor-level user accounts.
• File System: Unexpected or newly uploaded XML files in the WordPress uploads directory or plugin directories that do not correspond to legitimate administrator activity.
• Database: Unexpected new or modified product entries in the WordPress database (e.g., wp_posts or plugin-specific tables) created by non-administrator user accounts.
• Logs: WordPress debug logs or error logs referencing the cpis_admin_init function being called by low-privileged users.

Users should update the CP Image Store with Slideshow plugin to version 1.1.10 or later, which contains the fix for the authorization logic error in cpis_admin_init. The patch is documented in WordPress plugin changeset 3434716. As a temporary workaround, site administrators can restrict Contributor-level user registration or remove untrusted Contributor accounts until the update is applied (WordPress Changeset, Wordfence).