What is the CVSS score of CVE-2026-14955?

CVE-2026-14955 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Checkout Field Editor For Woocommerce Pro CVE-2026-14955

EUVD-2026-48764 MEDIUM

Path Traversal (CWE-22)

2026-07-25 Wordfence

GHSA-xghp-9m6j-2mx2

WordPress Path Traversal Checkout Field Editor For Woocommerce Pro Themehigh

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:06 vuln.today

CVE Published

Jul 25, 2026 - 05:34 nvd

MEDIUM 6.5

DescriptionCVE.org

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

Authenticated directory traversal in Checkout Field Editor Pro for WooCommerce up to 3.7.7 enables subscriber-level attackers to read arbitrary server files. Exploitation leverages the 'thwcfe_legacy_file' parameter. No active exploitation or public exploit code is currently known, and EPSS indicates low exploitation probability.