WP Customer Area EUVD-2026-36826

Exploitation requires (1) a WordPress site running WP Customer Area plugin version 8.3.4 or earlier, (2) the attacker holding a valid account assigned to one of the plugin's custom roles - the 'custom role' wording in the description indicates the traversal is reached through functionality gated to plugin-defined roles rather than fully anonymous endpoints, consistent with CVSS PR:L - and (3) network reachability to the WordPress front end (AV:N). Limiting factors: sites that do not expose customer self-registration, restrict the plugin's custom roles to vetted users, or already upgraded past 8.3.4 are not exploitable; no user interaction is required from another victim (UI:N), and no non-default plugin configuration beyond having custom roles in use is called out in the description.

The CVSS 3.1 base score of 8.8 reflects network attack vector, low complexity, low privileges, no user interaction, and high CIA impact - a serious profile for a WordPress plugin used on customer-facing portals. However, real-world risk is tempered by PR:L: the attacker must already hold a valid plugin account, which on many WP Customer Area deployments is granted to customers or partners, so the bar is low on public sites but higher on intranet/partner-only installs. No EPSS score, KEV listing, SSVC decision, or POC was provided in the intelligence set, so exploitation likelihood signals are absent and the only independent corroboration is the Patchstack advisory referenced. Net assessment: credible high-severity risk on public WordPress sites running WP Customer Area <= 8.3.4 that allow customer self-registration, but defenders should not yet treat it as on par with KEV-listed mass-exploited flaws.

An attacker registers or is granted a low-privilege custom role on a WordPress site running WP Customer Area 8.3.4 or earlier, then submits a crafted request to a plugin endpoint that accepts a file path parameter, inserting traversal sequences such as ../../wp-config.php to step out of the plugin's customer-area directory. The plugin resolves the path without proper normalization and reads, writes, or serves the targeted file, letting the attacker exfiltrate WordPress database credentials, overwrite site files, or stage further compromise. No public PoC is referenced in the intelligence at this time.