EUVD-2026-75243
GHSA-9qc5-g8h6-xx62
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Direct Download For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site - not that the requested file path belongs to that product's configured downloads - making exploitation viable on any WooCommerce site with at least one such product.
Articles & Coverage 1
Executive ViewAI
The Direct Download for WooCommerce plugin (versions 1.19 and earlier) contains an authorization bypass permitting unauthenticated attackers to read any file accessible to the web server, including wp-config.php with database credentials. This affects WordPress/WooCommerce installations offering free downloadable resources, creating direct exposure of database authentication secrets and server configuration to remote attackers. No vendor-released patch identified at time of analysis.
Within 24 hours, immediately disable or remove the Direct Download for WooCommerce plugin from all WordPress installations running version 1.19 or earlier, and review server access logs for exploitation indicators (requests with path traversal patterns to direct-download.php). Within 7 days, implement Web Application Firewall rules to block requests to the vulnerable plugin handler, and check the plugin vendor repository for security updates or patch releases. Within 30 days, develop and test an alternative free-download mechanism independent of this plugin, establish a notification system to alert when the vendor releases a patch, and complete migration to the replacement solution.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately disable the vulnerable plugin; restrict web server file system permissions to block access to wp-config.php and sensitive configuration files; implement firewall rules blocking /direct-download.php requests; enable detailed access logging on the plugin handler to detect exploitation attempts. These controls substantially reduce risk but do not eliminate it; migration to an alternative solution or application of a vendor patch remains necessary.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB