What is the CVSS score of CVE-2026-3464?

CVE-2026-3464 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-3464?

CVE-2026-3464 affects WP Customer Area plugin versions up to 8.3.4, allowing authenticated subscribers and higher-privileged users to read sensitive configuration files and delete critical WordPress…

How to fix or mitigate CVE-2026-3464?

Within 24 hours: Audit all WordPress installations for WP Customer Area plugin presence and current version; disable the plugin immediately if version 8.3.4 or earlier is detected. Within 7 days: Check for vendor advisory updates and patch availability; if patch releases, apply vendor-released patch to WP Customer Area plugin across all instances. Within 30 days: Conduct file integrity monitoring review on wp-config.php and other sensitive WordPress files; review user access logs for the ajax_attach_file function to identify any suspicious activity; restrict plugin access to administrator-only accounts pending full remediation.

PHP CVE-2026-3464

EUVD-2026-23448 HIGH

Path Traversal (CWE-22)

2026-04-17 Wordfence

GHSA-9859-fqhx-279v

PHP Path Traversal WordPress RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 17:22 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 17:03 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 16:45 euvd

EUVD-2026-23448

Analysis Generated

Apr 17, 2026 - 16:45 vuln.today

CVE Published

Apr 17, 2026 - 16:26 nvd

HIGH 8.8

DescriptionCVE.org

The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for authenticated attackers with a role that an administrator grants access to (e.g., Subscriber) to to read the contents of arbitrary files on the server, which can contain sensitive information, or delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

AnalysisAI

Path traversal in WP Customer Area plugin through version 8.3.4 enables low-privileged authenticated users (Subscriber-level or higher, as configured by administrators) to read sensitive files like wp-config.php or delete critical WordPress files to achieve remote code execution. Wordfence reported this vulnerability affecting the ajax_attach_file function, which fails to properly validate file paths. CVSS 8.8 reflects network-based exploitation with low complexity, though exploitation requires authentication and administrator-granted plugin access. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.

Technical ContextAI

This is a classic CWE-22 path traversal vulnerability in the Private File addon component of WP Customer Area (cpe:2.3:a:aguilatechnologies:wp_customer_area). The ajax_attach_file function in private-file-addon.class.php processes file attachment requests without proper canonicalization or validation of user-supplied file paths. The vulnerable code spans multiple files: the main addon class methods (lines 844, 883, 920), default handler implementations (lines 404, 422, 428 in private-file-default-handlers.class.php), and frontend JavaScript components that interface with the backend (file-attachment-manager.js line 170, ftp-uploader.js line 63). In PHP-based WordPress environments, insufficient path validation allows attackers to use directory traversal sequences (../) to escape intended file storage directories and access or delete arbitrary files in the web root or system directories. The plugin's design grants file management capabilities to any WordPress role that an administrator explicitly adds to the plugin's access control list, expanding the attack surface beyond WordPress's default permission model.

RemediationAI

Upgrade WP Customer Area plugin to version 8.3.5 or later, which contains the path validation fix documented in WordPress plugin repository changeset 3507868 (https://plugins.trac.wordpress.org/changeset/3507868/customer-area). Site administrators should verify the update resolves the issue by reviewing the changeset code changes to private-file-addon.class.php and private-file-default-handlers.class.php. If immediate patching is not feasible, implement these compensating controls: (1) Disable the Private File addon in WP Customer Area settings until patching is complete - this eliminates the vulnerable code path entirely but removes file management functionality for users. (2) Remove WP Customer Area access permissions from all untrusted user roles (Subscriber, Customer, etc.) and restrict the plugin to Administrator-only use - this reduces attack surface but may disrupt business workflows requiring customer file access. (3) Enable WordPress file modification restrictions by adding define('DISALLOW_FILE_EDIT', true); and define('DISALLOW_FILE_MODS', true); to wp-config.php to prevent file deletion exploitation paths, though this also blocks legitimate plugin updates. (4) Implement web application firewall rules to block requests containing directory traversal patterns (../, ..\, %2e%2e%2f) to the plugin's AJAX endpoints - this may cause false positives for legitimate filenames. Review WordPress access logs for suspicious ajax_attach_file requests accessing files outside intended upload directories. After patching, audit file permissions on wp-config.php and other sensitive files to ensure they were not accessed or modified.