What is the CVSS score of CVE-2026-49779?

CVE-2026-49779 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Tax Exempt WooCommerce CVE-2026-49779

Q: Which versions of Tax Exempt WooCommerce are affected by CVE-2026-49779?

Path traversal in the Tax Exempt for WooCommerce plugin (versions <= 1.9.3) by Addify enables authenticated customer-level users to read arbitrary files from the server's filesystem.

EUVD-2026-41341 MEDIUM

Path Traversal: '.../...//' (CWE-35)

2026-07-02 Patchstack

GHSA-3wjp-774c-xvqr

WordPress Path Traversal Wordpress Plugin Tax Exempt For Woocommerce Addify

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Exploitable over the network by any customer-role user (PR:L) with no interaction; read-only file access means confidentiality impact only, no integrity or availability effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:37 vuln.today

CVE Published

Jul 02, 2026 - 11:15 cve.org

MEDIUM 6.5

DescriptionCVE.org

Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions.

AnalysisAI

Path traversal in the Tax Exempt for WooCommerce plugin (versions <= 1.9.3) by Addify enables authenticated customer-level users to read arbitrary files from the server's filesystem. The vulnerability carries a CVSS 6.5 Medium score with high confidentiality impact, as a low-privileged account (a standard customer/shopper) can traverse directory boundaries to access sensitive files such as wp-config.php containing database credentials. No public exploit code or active CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected product is the 'Tax Exempt for WooCommerce' WordPress plugin developed by Addify, identified via CPE cpe:2.3:a:addify:tax_exempt_for_woocommerce:*:*:*:*:*:*:*:*. The root cause is classified as CWE-35 (Path Traversal), meaning the plugin fails to properly sanitize user-supplied input before using it to construct a file path on the server, allowing sequences such as '../' to escape the intended directory context. The vulnerability is specifically reachable by WooCommerce customer-role users - a built-in low-privilege role available to anyone who registers on a WooCommerce-enabled WordPress shop - making the attack surface broad on any public-facing e-commerce deployment running the plugin.

RemediationAI

The primary remediation is to update the Tax Exempt for WooCommerce plugin beyond version 1.9.3. The exact patched release version is not independently confirmed from the available data - only the vulnerable ceiling (1.9.3) is specified. Site administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-tax-exempt-plugin/vulnerability/wordpress-tax-exempt-for-woocommerce-plugin-1-9-3-path-traversal-vulnerability and the WordPress plugin repository for the latest available release. If an immediate update is not possible, a compensating control is to disable the tax exemption functionality within WooCommerce settings to remove the vulnerable code path from the attack surface; however, this will prevent legitimate tax-exempt customer workflows. Additionally, implementing a web application firewall (WAF) rule to block requests containing path traversal sequences (e.g., '../' or '%2e%2e/') targeting the plugin's endpoints can reduce exposure without disabling the feature entirely.