Wp Customer Area CVE-2026-3464

Exploitation requires three specific conditions: (1) Attacker must possess valid WordPress credentials for an account with a role that site administrators have explicitly granted access to WP Customer Area plugin functionality - this is NOT enabled by default and requires administrator action to add roles like Subscriber, Customer, or custom roles to the plugin's permission list. (2) The Private File addon within WP Customer Area must be active on the target site - this is a separately enabled component, not activated by default with base plugin installation. (3) The vulnerable code path (ajax_attach_file function) must be accessible to the attacker's role, which depends on the site's specific WP Customer Area access control configuration. Limiting factors include: authentication requirement (PR:L) prevents anonymous exploitation, WordPress's role-based access control means not all authenticated users can trigger the vulnerability (only those with granted plugin access), and the vulnerability affects the Private File addon specifically rather than core WordPress or the base plugin installation. Sites that restrict WP Customer Area to Administrator or Editor roles only, or that do not enable the Private File addon, are not exploitable despite running vulnerable plugin versions.

This vulnerability presents a high real-world risk despite requiring authentication (PR:L). The CVSS 8.8 score accurately reflects the severe potential impact (C:H/I:H/A:H) - attackers can read database credentials from wp-config.php, delete critical files to trigger RCE, or exfiltrate customer data. However, several factors constrain practical exploitation: (1) Attacker must have a WordPress account with a role that administrators have granted WP Customer Area access to, which is not default behavior. (2) The Private File addon must be enabled within the plugin. (3) No evidence of public exploit code exists (POC=NO), and the vulnerability is not in CISA KEV, indicating no confirmed widespread or targeted exploitation. The WordPress plugin repository shows a fix was committed (changeset 3507868), and Wordfence published detailed vulnerability intelligence including links to specific vulnerable code lines, enabling defenders to verify patching. Risk is highest for sites that grant Subscriber or Customer roles access to file management features, as these are typically low-trust user classes in WordPress. The deletion capability is particularly dangerous as removing wp-config.php or .htaccess files creates immediate RCE paths. EPSS data not provided, but low-complexity network exploitation (AC:L) combined with detailed technical disclosure increases likelihood of future exploit development.

An attacker registers a Subscriber account on a WordPress site using WP Customer Area with the Private File addon enabled. The site administrator has granted Subscribers access to the plugin's customer portal for document management. The attacker crafts a malicious AJAX request to the ajax_attach_file endpoint with a path parameter containing ../../../wp-config.php to read database credentials and security keys. Using the same technique with a deletion request, the attacker removes the .htaccess file from the WordPress root, then uploads a PHP web shell to a publicly accessible directory now unprotected by access controls. The attacker executes arbitrary commands on the server with web server privileges. No proof-of-concept code is publicly available, but the Wordfence advisory provides sufficient technical detail (specific vulnerable code lines and function names) for skilled attackers to develop working exploits.