PT-2026-55496 · Webandprint · Ean For Woocommerce

Choigyeongmin · Publicado 2026-07-03 · Atualizado 2026-07-03 · CVE-2026-14352

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar get fresh nonce and ar process user image AJAX handlers; the AES-256-CBC encryption key is derived from get option('ar licence key'), which returns false on default free installations and yields a predictable key attackers can use to encrypt their own path payloads; and the Referer check is trivially bypassed because the Referer header is attacker-controlled.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-14352

Produtos afetados

Ean For Woocommerce

Referências · 8

• https://plugins.trac.wordpress.org/changeset?old_path=%2Far-for-woocommerce/tags/8.40&new_path=%2Far-for-woocommerce/tags/8.41 · Nota
• https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/includes/ar-secure-download.php#L95 · Nota
• https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/ar-woocommerce.php#L143 · Nota
• https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/includes/ar-secure-download.php#L64 · Nota
• https://plugins.trac.wordpress.org/changeset/3593279/ar-for-woocommerce/trunk/includes/ar-secure-download.php · Nota
• https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/ar-woocommerce.php#L249 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-14352 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/2049712a-6ff2-4e2a-98f8-93a493a5bfd3?source=cve · Nota