PT-2026-56323 · Woocommerce · Bulk Order Update
Nthng
·
Published
2026-07-08
·
Updated
2026-07-08
·
CVE-2026-14500
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Bulk Order Update for WooCommerce versions prior to 1.7
Description
An unauthenticated arbitrary file read exists due to the
bouw fetch csv data() AJAX handler being registered on the wp ajax nopriv hook without capability or nonce checks. The handler accepts the csv url POST parameter, which is filtered by esc url raw() and validate file(). Because esc url raw() allows absolute filesystem paths and validate file() only blocks directory traversal patterns, the input is passed directly to fopen() and fgetcsv(). This allows an attacker to read the first line of arbitrary files on the server or use the handler as a file-existence oracle, which is a method used to verify if a specific file exists on a system.Recommendations
Update to a version later than 1.6.
As a temporary workaround, restrict access to the
bouw fetch csv data() function until a patch is applied.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bulk Order Update