The Bulk Order Update for WooCommerce plugin contains a CWE‑22 flaw that permits unauthenticated attackers to read arbitrary files on the web server. The vulnerability lies in the AJAX handler that is registered on the wp_ajax_nopriv_ hook, accepting a csv_url POST parameter without any capability or nonce checks. The input is only filtered by esc_url_raw() and validate_file(), which allow absolute file paths and do not block traversal, and is then passed directly to fopen()/fgetcsv(). As a result an attacker can capture the first line of any file, such as /etc/passwd, and use the endpoint as a file‑existence oracle.

WordPress sites that have the Bulk Order Update for WooCommerce plugin installed with a version equal to or older than 1.6 are affected. The flaw is confined to the plugin; it does not involve core WordPress components, but any site running that plugin version can be compromised.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the AJAX action is attached to wp_ajax_nopriv_, it is publicly reachable, allowing any internet‑reaching attacker to exploit it by submitting a POST request with a csv_url pointing to an arbitrary file path, without authentication or elevated privileges. The potential impact is partial disclosure of sensitive files and the ability to confirm the existence of files on the server.