What is the CVSS score of CVE-2026-14327?

CVE-2026-14327 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of AR for WordPress are affected by CVE-2026-14327?

A path-traversal vulnerability in AR for WordPress plugin (versions 8.40 and earlier) allows attackers to read arbitrary files accessible to the web server, including wp-config.php containing…

How to fix or mitigate CVE-2026-14327?

Within 24 hours: Audit all WordPress instances for AR for WordPress plugin version 8.40 or earlier and document affected systems. Within 7 days: Uninstall the plugin from all affected systems; if immediate removal is operationally infeasible, implement WAF rules to block requests to the secure-download handler. Within 30 days: Rotate all database credentials and API keys that may have been exposed; monitor vendor security advisories for patch availability and plan re-enablement only after confirming a patched version is released.

AR for WordPress CVE-2026-14327

EUVD-2026-41471 HIGH

Path Traversal (CWE-22)

2026-07-03 Wordfence

GHSA-c67p-rxvq-wp57

WordPress Path Traversal Wordpress Plugin Ar For Wordpress Webandprint

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Unauthenticated network attack (PR:N/AV:N) but AC:H because it needs a fetched nonce plus local key reproduction dependent on the default unset-licence config; read-only so C:H, I:N, A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 01:58 vuln.today

CVE Published

Jul 03, 2026 - 01:28 cve.org

HIGH 7.5

DescriptionCVE.org

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires an attacker to first obtain a valid nonce and secure nonce via the publicly accessible ar_get_fresh_nonce and ar_process_user_image nopriv AJAX handlers, and to reproduce the encryption key locally - both steps are fully achievable by an unauthenticated attacker on any default free or unlicensed installation where ar_licence_key is unset.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 04, 2026

AnalysisAI

Arbitrary file disclosure in the AR for WordPress plugin (versions up to and including 8.40) lets unauthenticated remote attackers read any file the web server can access via a path-traversal payload in the 'file' parameter of its secure-download handler. Exploitation is gated by a nonce and encryption-key check, but both can be satisfied remotely on default free or unlicensed installations, exposing wp-config.php and other secrets. No public exploit identified at time of analysis and the flaw is not in CISA KEV, though the vendor (Wordfence) documents the full unauthenticated bypass path.

Technical ContextAI

The affected code is a WordPress plugin from vendor 'webandprint' (CPE cpe:2.3:a:webandprint:ar_for_wordpress) that ships an ar-secure-download.php component intended to gate file downloads behind a nonce and an encrypted token. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the 'file' parameter is passed to a download routine without canonicalizing or restricting it to an allowed base directory, so '../' sequences resolve to arbitrary filesystem paths. The security wrapper relies on a nonce issued by the ar_get_fresh_nonce and ar_process_user_image nopriv (unauthenticated) AJAX handlers plus an encryption key derived from ar_licence_key; when that licence key is unset (the default on free/unlicensed sites), the key is reproducible client-side, collapsing the intended access control.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - a corrective changeset for the ar-for-wordpress repository is published at https://plugins.trac.wordpress.org/changeset?old=3593272%40ar-for-wordpress&new=3593272%40ar-for-wordpress, so administrators should update to the latest available plugin version above 8.40 as soon as the vendor tags a release incorporating it, and consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa375a8-ab07-45da-bc77-1e7edc996e05) for the confirmed fixed version. If an updated release is not yet installable, compensating controls include setting a valid ar_licence_key so the encryption key is no longer client-reproducible (closes the default-config bypass, but requires a licence), blocking or restricting the ar_get_fresh_nonce and ar_process_user_image AJAX actions and the ar-secure-download endpoint at the WAF/reverse-proxy layer (may break legitimate image/download features of the plugin), and applying a WAF rule to reject requests whose 'file' parameter contains '../' or absolute paths (low functional impact but bypassable by encoding tricks). As a last resort, deactivate the plugin until patched, accepting loss of its functionality.