Description
The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is derived from get_option('ar_licence_key'), which returns false on default free installations and yields a predictable key attackers can use to encrypt their own path payloads; and the Referer check is trivially bypassed because the Referer header is attacker-controlled.
Published: 2026-07-03
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The AR for WooCommerce WordPress plugin contains a directory traversal flaw that allows an unauthenticated attacker to read the contents of any file accessible to the web‑server process using the unvalidated "file" query parameter. The vulnerability is enabled by three broken access controls: nonces that can be created without authentication, a predictable encryption key derived from a missing licence option, and a Referer check that can be easily bypassed with attacker‑controlled headers.

Affected Systems

All installations of WebAndPrint’s AR for WooCommerce plugin for WordPress running version 8.40 or earlier are affected. No patched release is documented in the advisory; therefore, the status of versions 8.41 and newer remains uncertain.

Risk and Exploitability

The CVSS score of 7.5 categorizes this issue as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by sending an unauthenticated HTTP request to the plugin’s Ajax endpoint with a crafted "file" parameter that includes directory traversal sequences, thereby reading any file with permissions for the web‑server process.

Generated by OpenCVE AI on August 1, 2026 at 20:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AR for WooCommerce to a version newer than 8.40 once an update that addresses the directory traversal flaw is available.
  • If an update is not yet available, restrict access to the plugin’s Ajax endpoints that expose the "file" parameter so that only authenticated users can invoke them, or remove the unauthenticated routes entirely.
  • Configure a web application firewall or reverse proxy rule that detects and blocks HTTP requests containing directory traversal patterns in the "file" parameter, and ensure that sensitive files are not world‑readable by the web‑server process.

Generated by OpenCVE AI on August 1, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Webandprint
Webandprint ar For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Webandprint
Webandprint ar For Woocommerce
Wordpress
Wordpress wordpress

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Description The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is derived from get_option('ar_licence_key'), which returns false on default free installations and yields a predictable key attackers can use to encrypt their own path payloads; and the Referer check is trivially bypassed because the Referer header is attacker-controlled.
Title AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Webandprint Ar For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-06T16:24:08.921Z

Reserved: 2026-07-01T17:00:42.202Z

Link: CVE-2026-14352

cve-icon Vulnrichment

Updated: 2026-07-06T16:24:00.951Z

cve-icon NVD

Status : Deferred

Published: 2026-07-03T06:16:21.787

Modified: 2026-07-06T18:02:49.450

Link: CVE-2026-14352

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T21:00:08Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')