EUVD-2026-42175
GHSA-74pw-3rq8-72px
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated AJAX endpoint with no complexity barrier; confidentiality is Low because only the first line per file is disclosed, and no integrity or availability impact exists.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook with no capability or nonce check, and passing the attacker-supplied csv_url POST parameter - filtered only by esc_url_raw() (which leaves absolute filesystem paths intact) and validate_file() (which only rejects '..' traversal patterns) - directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.
AnalysisAI
Unauthenticated arbitrary file read in Bulk Order Update for WooCommerce (versions up to and including 1.6) exposes the first line of any server-side file to remote attackers without credentials. The plugin's AJAX handler bouw_fetch_csv_data() is registered on the wp_ajax_nopriv_ hook - meaning WordPress serves it to unauthenticated users - and passes attacker-controlled filesystem paths directly to fopen()/fgetcsv(), reflecting parsed output in the JSON response. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires no authentication and no interaction, making it straightforward to exploit against any site with the plugin active.
Technical ContextAI
The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) within a WordPress PHP plugin identified by CPE cpe:2.3:a:sayantandas20:bulk_order_update_for_woocommerce:*:*:*:*:*:*:*:*. WordPress's wp_ajax_nopriv_ hook exposes AJAX actions to unauthenticated HTTP requests, making it a high-risk registration point for any handler that touches the filesystem. The bouw_fetch_csv_data() function applies two filters to the csv_url POST parameter: esc_url_raw(), a sanitization function designed for URL output encoding that intentionally preserves absolute local paths (e.g., /etc/passwd), and validate_file(), which only rejects sequences containing '..' but permits absolute paths entirely. The sanitized value is then passed to PHP's native fopen() and fgetcsv() functions. Because fgetcsv() treats any readable file as a CSV and returns the first parsed row, and because the handler serializes this output into a JSON HTTP response, the first newline-delimited line of any file the web server process can read is returned to the unauthenticated caller. The handler additionally functions as a file-existence oracle: differing HTTP or JSON error responses between readable, unreadable, and nonexistent paths allow attackers to enumerate filesystem contents. Source code evidence is available at the WordPress plugin trac for version 1.6, lines 23, 33, and 48 of inc/plugin-html.php.
RemediationAI
No vendor-released patch has been identified at time of analysis; a patched version number is not confirmed in any available reference. Site operators should immediately deactivate and uninstall the Bulk Order Update for WooCommerce plugin pending a confirmed fix from the plugin author. As a compensating control, web application firewall rules can be configured to block POST requests to wp-admin/admin-ajax.php where the action parameter equals bouw_fetch_csv_data; this mitigates exploitation without requiring plugin removal but may break legitimate bulk order update functionality. Operators relying on the plugin's features should monitor the WordPress plugin repository (https://wordpress.org/plugins/bulk-order-update-for-woocommerce/) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/d3aa1f74-6372-4abe-894b-07ad3e81ea81) for patch availability. Additionally, ensuring the web server process runs with a restricted user account and tight filesystem permissions will reduce the scope of files readable via this vector.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today