{"id":"CVE-2026-122265","published":"2026-11-07T07:17:04.697","lastModified":"2026-11-08T19:17:37.933","description":"The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().","cvssScore":5.9,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/File.php#L1055","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L277","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L284","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L294","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L644","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L882","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-woocommerce","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-woocommerce/trunk/classes/com/Media.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97977c09-b8e0-4ad3-8819-67d7bcff596a?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}