PT-2026-33465 · WordPress · Wp Customer Area

Angus Girvan · Published 2026-04-17 · Updated 2026-04-19 · CVE-2026-3464

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Customer Area versions prior to 8.3.5

Description Insufficient file path validation in the ajax attach file() function allows authenticated attackers with roles granted by an administrator, such as Subscriber, to read or delete arbitrary files on the server. Reading files may expose sensitive information, while deleting files, such as 'wp-config.php', can lead to remote code execution.

Recommendations Update to a version newer than 8.3.4. As a temporary workaround, restrict access to the ajax attach file() function until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3464

Affected Products

Wp Customer Area

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-3464 · Security Note
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-default-handlers.class.php#L404 · Note
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-addon.class.php#L883 · Note
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/templates/private-attachments-add-ftp-folder-frontend.template.php#L17 · Note
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-addon.class.php#L920 · Note
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-addon.class.php#L844 · Note
• https://twitter.com/CVEnew/status/2045889727849435139 · Twitter Post
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-default-handlers.class.php#L428 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/aadf1f4c-c852-4167-9b09-7e679a953725?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2045242666087035251 · Twitter Post
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-default-handlers.class.php#L422 · Note
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/js/common/files/file-attachment-manager.js#L170 · Note
• https://plugins.trac.wordpress.org/changeset/3507868/customer-area · Note
• https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/js/common/files/ftp-uploader.js#L63 · Note