EUVD-2026-43364Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Membership For WooCommerce ≤3.1.0
-
DeliverySend crafted request with ../ path parameter
-
ExploitBypass directory restriction via traversal
-
ExecutionTrigger arbitrary file deletion
-
PersistRemove critical file (wp-config.php)
-
ImpactSite denial of service / reset
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected site must be running WP Swings Membership For WooCommerce version 3.1.0 or earlier with the plugin active and its file-handling endpoint reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are documented as required - remote unauthenticated exploitation appears feasible against default installations. The primary limiting factors are that the vulnerable plugin must be installed and active, and that the impact of a deleted file depends on web-server filesystem permissions for the PHP process; the exact vulnerable feature/endpoint is not detailed in the provided data and should be confirmed against the Patchstack advisory. |
| Impact | The signals are moderately strong but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H = 8.6 High) describes a network-reachable, low-complexity, unauthenticated attack with changed scope and high availability impact - a serious combination because it requires no user interaction and no credentials. However, there is no EPSS score, no KEV listing, and no known public POC in the provided data, so real-world exploitation pressure is currently unquantified. The rating reflects potential for site-wide denial of service via deletion of essential files rather than data theft (C:N/I:N). This is a genuine priority for anyone running the plugin, but the absence of EPSS/KEV means it is not yet confirmed to be under active or automated exploitation; note also that arbitrary file deletion arguably carries an integrity impact that the published vector scores as I:N - verify scope with the vendor advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the plugin's file-handling endpoint, supplying a path parameter containing directory-traversal sequences that point outside the plugin's intended directory. Because no credentials or user interaction are required (PR:N/UI:N), the attacker deletes a critical file such as wp-config.php, taking the WordPress site offline or forcing it into an installation/reset state. No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Arbitrary file deletion in WP Swings' Membership For WooCommerce WordPress plugin (all versions up to and including 3.1.0) lets remote attackers delete files outside the intended directory via unsanitized path input. The CVSS vector (PR:N) indicates the flaw is reachable without authentication, and the scope-changed rating reflects that deletion of critical files (e.g., wp-config.php) can break or reset the entire WordPress site. No public exploit has been identified at time of analysis; the issue was reported by Patchstack.
RemediationAI
No vendor-released patched version is identified in the available data - the advisory lists impact only through 3.1.0 with no confirmed fixed release - so treat this as unpatched and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-plugin-3-1-0-arbitrary-file-deletion-vulnerability) and the plugin changelog for a release above 3.1.0, upgrading immediately when one appears. Until a fix exists, the most effective compensating control is to deactivate and remove the Membership For WooCommerce plugin (trade-off: membership features go offline); if it must stay active, deploy a WordPress WAF or Patchstack virtual patch and add web-server/WAF rules that block traversal sequences (../, encoded %2e%2e) and restrict access to the plugin's file-handling AJAX endpoints, and ensure the web-server user has least-privilege filesystem permissions so critical files like wp-config.php cannot be deleted (trade-off: overly strict rules may block legitimate file operations).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-22 Path Traversal in a WooCommerce membership extension. WooCommerce plugins frequently expose AJAX actions or file-handling endpoints that accept a filename or path parameter; when that parameter is not canonicalized or restricted to a whitelisted directory, an attacker can inject traversal sequences (../) to reference files anywhere on the filesystem the web server user can reach. Here the traversal is chained to a file-deletion operation, so the impact is destructive rather than informational. The single affected CPE is cpe:2.3:a:wp_swings:membership_for_woocommerce:*:*:*:*:*:*:*:*, i.e., the WP Swings 'membership-for-woocommerce' plugin, with no version lower bound published (n/a through 3.1.0).
Know when Membership For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network path traversal (PR:N/UI:N/AC:L); deletion of files outside the app crosses a security boundary (S:C) with high availability impact and no confidentiality loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.
Articles & Coverage 1
Executive ViewAI
WP Swings' Membership For WooCommerce plugin (versions through 3.1.0) contains a critical vulnerability allowing unauthenticated remote attackers to delete arbitrary files, including essential WordPress configuration files that can render entire websites non-functional. Organizations running this plugin on WordPress sites face immediate risk of complete site compromise and operational disruption.
Until vendor patch available: disable the Membership For WooCommerce plugin immediately; implement Web Application Firewall (WAF) rules blocking path traversal patterns (../, etc.); apply restrictive file system permissions to wp-config.php and other critical files; enable file deletion and modification alerts on all WordPress directories; maintain daily backups with point-in-time recovery capability; consider alternative membership plugins from verified vendors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
GitHub PoC
Exploit-DB