EUVD-2026-60937
GHSA-2gq3-vhpc-7q85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible with no authentication, complexity, or interaction barriers; impact is confidentiality-only as file download does not modify or disrupt server state.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
AnalysisAI
Unauthenticated arbitrary file download in the Extra Product Options & Add-Ons for WooCommerce plugin (all versions prior to 7.6) allows any remote attacker without credentials to traverse directory paths and retrieve arbitrary files from the web server, including highly sensitive files such as wp-config.php containing database credentials and secret keys. Rooted in CWE-22 path traversal, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with high confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Extra Product Options & Add-Ons for WooCommerce plugin must be installed and active on a WordPress site running WooCommerce, with a plugin version below 7.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the real-world risk profile: network-reachable, trivially exploitable, requiring no authentication or user interaction, and yielding high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a public WooCommerce store running the vulnerable plugin version by fingerprinting the plugin path or version metadata. The attacker sends a crafted HTTP GET request to a plugin-exposed file download endpoint, embedding path traversal sequences in the filename or path parameter to escape the plugin directory and target wp-config.php. … |
| Remediation | Upgrade the Extra Product Options & Add-Ons for WooCommerce plugin to version 7.6 or later, which contains the vendor-released patch per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-tm-extra-product-options/vulnerability/wordpress-extra-product-options-add-ons-for-woocommerce-plugin-7-6-arbitrary-file-download-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately identify all WooCommerce installations using Extra Product Options & Add-Ons plugin versions prior to 7.6 and apply vendor-released patch version 7.6. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today