EUVD-2026-82758
GHSA-qq4m-495r-qfhf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as shop manager
-
DeliveryCraft filename with traversal sequence
-
ExploitExporter reads arbitrary file path
-
ExecutionSensitive file contents returned
-
ImpactHarvest credentials/secrets for escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with shop-manager-level access or above on a WordPress site running the Store Exporter (woocommerce-exporter) plugin version <= 2.8.0, which in turn presupposes WooCommerce is installed. Exploitation is limited by this privilege gate (PR:H) - an anonymous attacker cannot reach the vulnerable 'filename' export handler - and impact is confined to reading server-readable files (no write or code execution). No user interaction beyond the attacker's own request is needed. |
| Impact | This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N = 4.9 Medium) is internally consistent with the description: network-reachable, low complexity, but gated behind shop-manager (or higher) privileges - a trusted WooCommerce store role, not an anonymous attacker. The impact is confidentiality-only (C:H, I:N, A:N), reflecting arbitrary file read with no write or availability effect. No EPSS score, no CISA KEV listing, and no public POC are present in the input - only a Wordfence threat-intel entry and the plugin's own source/changeset references. There is no SSVC decision data provided. The signals do not conflict: a moderate CVSS, high privilege requirement, and absence of exploitation evidence all point to a real-but-contained flaw rather than an urgent, widely-exploited one. The main residual risk is that a shop manager is a comparatively low-trust commerce role that can be held by staff or compromised via credential theft, and arbitrary file read (wp-config.php, DB credentials, secrets) can escalate to broader compromise. |
| Exploit ScenarioDerived | An attacker who holds or has compromised a shop-manager account on a WooCommerce store submits an export request with a crafted 'filename' parameter containing directory-traversal sequences (e.g. ../../../wp-config.php), causing the exporter to read and return the contents of an arbitrary server file. No public exploit code is identified at time of analysis, but the vulnerable source lines are cited in the plugin's public trac repository, lowering the bar to reconstruct the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Arbitrary file read in the WordPress plugin Store Exporter (woocommerce-exporter) through version 2.8.0 allows an authenticated attacker holding shop-manager-level access or above to supply a crafted 'filename' parameter and retrieve the contents of any file readable by the web server. The traversal is confined to disclosure - there is no write, no code execution, and no path to privilege escalation beyond the account already required - and the high-privilege prerequisite (CVSS PR:H, score 4.9) keeps this a genuine but low-priority issue rather than an urgent one. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; exploitation is only reachable from the plugin's export handler by a user who already holds elevated store-management rights.
RemediationAI
Vendor-released patch: not independently confirmed - the referenced WordPress.org changeset 3689535 for woocommerce-exporter (https://plugins.trac.wordpress.org/changeset?reponame=&old=3689535%40woocommerce-exporter&new=3689535%40woocommerce-exporter) indicates an upstream fix has been committed, but no tagged release version above 2.8.0 is confirmed in the supplied data, so administrators should check the plugin's WordPress.org page and apply the first release newer than 2.8.0 before treating the issue as closed. If upgrading is not immediately possible, the most effective compensating control is to reduce the attack surface at the privilege gate: remove the shop_manager role (and any custom roles with equivalent WooCommerce management capabilities) from untrusted users, or strip the export-related capability from those roles with a role-editing plugin - the trade-off is that legitimate staff lose the ability to generate exports. Alternatively, deactivate Store Exporter entirely if exports are not operationally required, which eliminates the vulnerable handler at the cost of the export functionality. Because the flaw is a read-only traversal, host-level hardening also helps: run WordPress with a dedicated least-privilege OS/FPM user, tighten file permissions on wp-config.php and other credential files so the web user cannot read them, and move secrets out of files reachable by the web process. Logging and alerting on export download requests containing traversal sequences (../, encoded variants) provides detection coverage while the patch is being rolled out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) in the export download handling of the Store Exporter plugin, a WooCommerce-adjacent extension that generates CSV/XML exports of products, orders, subscriptions and customers. The vulnerable code paths are in includes/Abstracts/Abstract_Exporter.php (referenced lines 396, 418 and 1011) and includes/Classes/WP_Admin.php (line 325), where the user-supplied 'filename' parameter is used to resolve a file for streaming back to the client without adequate canonicalisation or directory confinement, so sequences such as ../ can escape the intended export directory. Because the handler executes inside WordPress with the web server's filesystem identity, anything the server process can read - wp-config.php with database credentials and salts, .env files, other plugins' configuration, or system files accessible to that user - is potentially exposed. The CPE cpe:2.3:a:jkohlbach:store_exporter_-_export_woocommerce_products,_orders,_subscriptions,_customers identifies the vendor as jkohlbach and the affected package across all versions up to and including 2.8.0; the plugin's own dependency on WooCommerce means an affected site is by definition running WooCommerce as well. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms network reachability, no user interaction, unchanged scope, and a high-confidentiality/low-integrity/low-availability impact profile consistent with a pure disclosure bug gated behind high privileges.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Shop-manager role is a privileged trusted account so PR:H; network-reachable admin action with no user interaction; arbitrary file read yields confidentiality only, no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Store Exporter - Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB