CVE-2026-122265 · Package
NO FIX YET · SEE WHAT TO DO
The Vanquish Upload Files for WooCommerce WordPress plugin, up to and including 2.7.13, has a directory traversal flaw in its 'vanupfi_file_name' parameter. A logged-in subscriber can read arbitrary files on the server, such as wp-config.php, which can expose database credentials and other secrets.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Vanquish Upload Files for WooCommerce plugin at version 2.7.13 or lower. The flaw needs an authenticated account with subscriber-level access, so sites that allow open registration or have untrusted users are most exposed. Sites without this plugin are not affected.
Not affected if plugin-not-installed, registration-closed
Who cares self-hosted, woocommerce, wordpress
2.7.13 or lower in the WordPress plugins screen or the plugin's main file header.2.7.13 are reported as affected-range boundary only; the fixed version is unknown from the sources.The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.