What is the CVSS score of CVE-2026-22334?

CVE-2026-22334 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of WooCommerce Book Price are affected by CVE-2026-22334?

The WooCommerce Book Price WordPress plugin (versions 1.3 and earlier) contains a path traversal flaw that allows unauthenticated remote attackers to download arbitrary files from affected web…

How to fix or mitigate CVE-2026-22334?

Within 24 hours: identify all WordPress installations using WooCommerce Book Price plugin and verify version; immediately disable the plugin as a temporary containment measure. Within 7 days: contact the plugin vendor to determine if a patched version is available; implement network-based mitigations such as WAF rules blocking path traversal patterns (e.g., '../', URL-encoded variants). Within 30 days: apply vendor-released patch when available and re-enable the plugin, or identify and deploy an alternative solution if the vendor does not release a fix.

WooCommerce Book Price CVE-2026-22334

EUVD-2026-37656 HIGH

Path Traversal (CWE-22)

2026-06-17 Patchstack

WordPress Path Traversal Wordpress Plugin Woocommerce Book Price

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable WordPress endpoint with low complexity; Patchstack scopes it to Subscriber role so PR:L not PR:N; arbitrary file read yields C:H, no write or DoS so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:32 vuln.today

CVE Published

Jun 17, 2026 - 09:50 cve.org

HIGH 7.5

DescriptionCVE.org

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

AnalysisAI

Arbitrary file download in the WooCommerce Book Price WordPress plugin (versions 1.3 and earlier) allows remote attackers to retrieve arbitrary files from the underlying server filesystem via path traversal. The CVSS vector indicates network-reachable exploitation without authentication or user interaction, yielding high confidentiality impact with no integrity or availability effects. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the WooCommerce Book Price plugin published by wpos (CPE cpe:2.3:a:wpos:woocommerce_book_price), a WordPress extension that adds book-pricing functionality to WooCommerce stores. The root-cause class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): a file-download handler exposed by the plugin almost certainly accepts a user-controlled file path or filename parameter and concatenates it into a filesystem read without canonicalising the path or constraining it to an allow-listed directory. Although the CVSS vector indicates PR:N, Patchstack categorises this as a 'Subscriber' issue, implying the vulnerable endpoint is reachable via an authenticated WordPress nonce/AJAX action available to the lowest-privilege role - a discrepancy worth verifying against the Patchstack advisory.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version is not independently confirmed from the supplied references, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/woo-book-price/vulnerability/wordpress-woocommerce-book-price-plugin-1-3-arbitrary-file-download-vulnerability and upgrade to any release strictly newer than 1.3 once published by the wpos vendor. Until a fixed plugin version is verified, deactivate and remove the WooCommerce Book Price plugin entirely (this disables book-price display on storefronts) or, if it must remain active, block the plugin's file-download AJAX action and admin-ajax handlers at a WAF (ModSecurity / Wordfence / Patchstack mU-plugin) by denying requests whose parameters contain '../' or absolute paths, and tighten WordPress registration so untrusted users cannot self-provision Subscriber accounts that reach the vulnerable endpoint. Restrict filesystem permissions so the web user cannot read wp-config.php or /etc/passwd to limit exfiltration impact, accepting that this hardens defence in depth but does not close the underlying flaw.