CVE-2026-122265

Vulnerability Description

The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().

CVSS Score

Related Weaknesses (CWE)

References

• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce
• https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-w
• https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-w
• https://www.wordfence.com/threat-intel/vulnerabilities/id/97977c09-b8e0-4ad3-881