EUVD-2026-36870
GHSA-p254-h56f-52gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress plugin version
-
DeliverySend crafted request with traversal payload
-
ExploitPlugin concatenates path without validation
-
ExecutionWeb server reads arbitrary file
-
PersistDisclose wp-config.php credentials
-
ImpactPivot to database or admin session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of WPC Product Options for WooCommerce plugin versions ≤ 3.2.1 on any internet-reachable WordPress site where the plugin is installed and active. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network reach, low complexity, no privileges, and no user interaction. Limiting factors are narrow: the target site must have the specific plugin installed and activated, the vulnerable download endpoint must be reachable through the WordPress front controller (not blocked by a WAF or hardened reverse proxy), and the web server process must have filesystem read permission to the targeted file - typical for wp-config.php under standard WordPress deployments. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) accurately reflects a network-reachable, no-auth, no-interaction read primitive with high confidentiality impact but no integrity or availability impact - consistent with arbitrary file disclosure rather than RCE. There is no EPSS score, CISA KEV listing, or SSVC decision data in the input, and no public PoC is referenced, so exploitation is currently theoretical from open-source signals; however, WordPress plugin file-download flaws of this shape are routinely weaponized within days of Patchstack disclosure because they enable wp-config.php exfiltration (database credentials, auth keys), which is a high-value secondary objective. Treat this as priority remediation for any storefront running the plugin, while acknowledging that real-world exploitation telemetry is not yet available to confirm scanning activity. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WooCommerce storefront running WPC Product Options ≤ 3.2.1 via plugin fingerprinting, then sends a crafted HTTP request to the vulnerable plugin endpoint with a traversal payload such as '../../../../wp-config.php' in the filename parameter. The server returns the file contents, disclosing database credentials and WordPress auth keys, which the attacker then uses to pivot to full site compromise via direct DB access or forged session cookies. No public PoC is referenced in the advisory at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated arbitrary file download in the WPC Product Options for WooCommerce WordPress plugin (versions ≤ 3.2.1) allows remote attackers to retrieve arbitrary files from the underlying server without any credentials. The flaw is a classic path traversal (CWE-22) reachable over the network at low complexity, and while no public exploit identified at time of analysis, the disclosure by Patchstack and trivial attack profile make opportunistic scanning likely against WooCommerce storefronts running this plugin.
RemediationAI
Upgrade the WPC Product Options for WooCommerce plugin to a version newer than 3.2.1 once the vendor publishes a fixed release; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpc-product-options/vulnerability/wordpress-wpc-product-options-for-woocommerce-plugin-3-2-1-arbitrary-file-download-vulnerability should be monitored for the exact patched version, as no fixed version is independently confirmed in the available data - Upstream fix status not independently confirmed. Until a patch is applied, deactivate and remove the plugin if business needs allow (loss of product option customization on storefront), or place a WAF/virtual-patch rule (e.g., Patchstack, Wordfence) in front of the site blocking requests containing '../', URL-encoded traversal sequences ('%2e%2e%2f'), or absolute paths in plugin request parameters - accepting that overly broad rules may break legitimate file-handling requests. As a defense-in-depth step, rotate WordPress secrets in wp-config.php (AUTH_KEY, SECURE_AUTH_KEY, etc.) and database credentials if you suspect the endpoint was exposed, since arbitrary file read commonly targets this file.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPC Product Options for WooCommerce is a WordPress plugin by WPClever (CPE: cpe:2.3:a:wpclever:wpc_product_options_for_woocommerce) that extends WooCommerce product pages with configurable options such as add-ons, variants, and file selections. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning a user-controlled input - likely a filename or path parameter passed to a download/serve handler - is concatenated into a filesystem path without canonicalization or allowlist validation, letting sequences like '../' escape the intended directory. Because the endpoint does not enforce authentication, the traversal is reachable by any anonymous HTTP client that can contact the WordPress front-end.
Know when Wpc Product Options For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable path traversal yields arbitrary file read (C:H) with no write or denial-of-service primitive, so I:N and A:N; no user interaction required.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.
Executive ViewAI
Organizations running WooCommerce with the WPC Product Options plugin (version 3.2.1 or earlier) face immediate risk of unauthorized access to sensitive server files, including database credentials and customer data, through an unauthenticated path traversal flaw. No patch is currently available from the vendor, making this a critical vulnerability requiring defensive action before opportunistic scanning occurs. The trivial attack complexity and network accessibility create significant exposure for any affected storefront.
Enable Web Application Firewall (WAF) rules to block requests with path traversal patterns ("../", "..%2F") targeting plugin endpoints. Implement IP-based access controls restricting wp-admin/admin-ajax.php to known administrative networks. Monitor web server access logs for anomalous requests to the vulnerable endpoint and file system access logs for unauthorized reads of config files (wp-config.php, .htaccess). As an immediate emergency measure, disable the WPC Product Options plugin entirely until a patched version is released by the vendor. Ensure daily backups are tested and current.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB