Description
The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is derived from get_option('ar_licence_key'), which returns false on default free installations and yields a predictable key attackers can use to encrypt their own path payloads; and the Referer check is trivially bypassed because the Referer header is attacker-controlled.
Published: 2026-07-03
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The AR for WooCommerce WordPress plugin contains a directory traversal flaw that allows an unauthenticated actor to read any file reachable by the web‑server process. The vulnerability arises from the unchecked "file" query parameter in the plugin’s AJAX endpoints and is augmented by three broken access controls: freely minted nonces, a predictable encryption key derived from a missing licence option, and a bypassable Referer check. Because arbitrary files can be read, sensitive configuration, credential, or system files may be exposed to attackers.

Affected Systems

All installations of WebAndPrint’s AR for WooCommerce plugin for WordPress running version 8.40 or earlier are affected. No fixed release is documented in the advisory; consequently, the status of versions 8.41 and newer remains uncertain.

Risk and Exploitability

The CVSS score of 7.5 categorizes this issue as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by sending an unauthenticated HTTP request to the plugin’s Ajax endpoint with a crafted "file" parameter that includes directory traversal sequences, thereby reading any file with permissions for the web‑server process.

Generated by OpenCVE AI on July 21, 2026 at 10:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest available version of the AR for WooCommerce plugin that contains the directory traversal fix.
  • Restrict access to the Ajax endpoints that expose the "file" parameter so that only authenticated users can invoke them, or remove the unauthenticated routes entirely.
  • Configure a web application firewall or reverse proxy rule that detects and blocks HTTP requests containing directory traversal patterns in the "file" parameter, and ensure that sensitive files are not world‑readable by the web‑server process.

Generated by OpenCVE AI on July 21, 2026 at 10:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Webandprint
Webandprint ar For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Webandprint
Webandprint ar For Woocommerce
Wordpress
Wordpress wordpress

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Description The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is derived from get_option('ar_licence_key'), which returns false on default free installations and yields a predictable key attackers can use to encrypt their own path payloads; and the Referer check is trivially bypassed because the Referer header is attacker-controlled.
Title AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Webandprint Ar For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-06T16:24:08.921Z

Reserved: 2026-07-01T17:00:42.202Z

Link: CVE-2026-14352

cve-icon Vulnrichment

Updated: 2026-07-06T16:24:00.951Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:30:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')