PT-2026-50844 · Teamwsa · Woosa – Marktplaats For Woocommerce

Abhirup Konwar · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-7547

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Woosa – Marktplaats for WooCommerce versions prior to 2.0.5

Description Insufficient path sanitization in the render logs ui() function allows authenticated attackers with Administrator-level access to read arbitrary files on the server, such as wp-config. The issue occurs because the plugin accepts a base64-encoded file name via the 'log file' GET parameter and concatenates it with the log directory path without verifying that the resulting path stays within the intended directory. This leads to a Path Traversal, which is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to a version later than 2.0.4. As a temporary workaround, restrict access to the render logs ui() function or the 'log file' parameter until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7547

Affected Products

Woosa – Marktplaats For Woocommerce

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-7547 · Security Note
• https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/trunk/vendor/woosa/logger/class-module-logger-hook-settings.php#L190 · Note
• https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.4/vendor/woosa/logger/class-module-logger-hook-settings.php#L190 · Note
• https://twitter.com/VulmonFeeds/status/2067868149056155903 · Twitter Post
• https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.5/vendor/woosa/logger/class-module-logger-hook-settings.php#L190 · Note
• https://twitter.com/CVEnew/status/2067932724908970338 · Twitter Post
• https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.5/vendor/woosa/logger/class-module-logger-hook-settings.php#L177 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3576889%40integration-marktplaats-for-woocommerce&new=3576889%40integration-marktplaats-for-woocommerce&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.4/vendor/woosa/logger/class-module-logger-hook-settings.php#L177 · Note
• https://twitter.com/infoflowcloud/status/2067934580925997397 · Twitter Post
• https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/trunk/vendor/woosa/logger/class-module-logger-hook-settings.php#L177 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3e765e05-9be1-40fa-97f2-a6e57728cb85?source=cve · Note