{"id":"CVE-2026-122265","kind":"vulnerability","aliases":["CVE-2026-122265"],"related":[],"title":"WordPress Vanquish Upload Files plugin: subscribers can read arbitrary server files","description":"The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().","summary":"The Vanquish Upload Files for WooCommerce WordPress plugin, up to and including 2.7.13, has a directory traversal flaw in its 'vanupfi_file_name' parameter. A logged-in subscriber can read arbitrary files on the server, such as wp-config.php, which can expose database credentials and other secrets.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","registration-closed"],"how_to_check":"- Check whether the Vanquish Upload Files for WooCommerce plugin is installed and whether its version is `2.7.13` or lower in the WordPress plugins screen or the plugin's main file header.\n- Check whether subscriber-level accounts can register on the site, since the flaw needs only that level of access.","fix":"- Versions above `2.7.13` are reported as affected-range boundary only; the fixed version is unknown from the sources.","status":"open","published_at":"2026-11-07T07:17:04+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","triaged_at":"2026-11-07T07:47:13+00:00","updated_at":"2026-11-07T07:47:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T07:47:13Z","model":"claude-haiku-5-5","output":{"fix":"- Versions above `2.7.13` are reported as affected-range boundary only; the fixed version is unknown from the sources.","reach":"internet","title":"WordPress Vanquish Upload Files plugin: subscribers can read arbitrary server files","impact":"medium","summary":"The Vanquish Upload Files for WooCommerce WordPress plugin, up to and including 2.7.13, has a directory traversal flaw in its 'vanupfi_file_name' parameter. A logged-in subscriber can read arbitrary files on the server, such as wp-config.php, which can expose database credentials and other secrets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads server files including wp-config.php secrets","analyst_note":"Confirm the first fixed version of the Vanquish Upload Files plugin on the WordPress plugin page or the Wordfence/NVD entry.","how_to_check":"- Check whether the Vanquish Upload Files for WooCommerce plugin is installed and whether its version is `2.7.13` or lower in the WordPress plugins screen or the plugin's main file header.\n- Check whether subscriber-level accounts can register on the site, since the flaw needs only that level of access.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","registration-closed"],"who_is_affected":"Sites running the Vanquish Upload Files for WooCommerce plugin at version 2.7.13 or lower. The flaw needs an authenticated account with subscriber-level access, so sites that allow open registration or have untrusted users are most exposed. Sites without this plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00077,"input_tokens":4411,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122265':14A,17A '-2026':13A,16A '/.pdf/../../../../wp-config.php':181C '2.7.13':36B,92C 'access':111C,160C 'achiev':133C 'allow':175C 'arbitrari':9A,55B,119C 'attack':106C 'authent':105C 'author':130C 'branch':168C,186C 'bypass':131C 'caus':145C 'check':163C 'circuit':155C 'contain':126C 'content':117C 'credenti':67B 'cve':12A,15A 'databas':66B 'directori':39B,83C 'e.g':142C 'exist':139C 'expos':65B 'fals':151C 'file':4A,11A,27B,45B,56B,74C,96C,120C,162C 'flaw':41B 'get':147C 'host':21B 'id':141C 'includ':35B,91C 'inform':128C 'level':110C 'log':50B 'logged-in':49B 'loos':171C 'make':101C 'match':174C 'name':46B,97C 'non':138C 'non-exist':137C 'order':140C,148C,161C 'packag':18B 'paramet':47B,98C,99C 'payload':178C 'pdf':143C,167C,185C 'plugin':5A,31B,77C 'possibl':103C 'read':8A,54B,115C 'readfil':192C 'return':150C 'satisfi':183C 'secret':70B 'selector':169C 'self':20B 'self-host':19B 'sensit':127C 'server':10A,59B,123C 'short':154C 'short-circuit':153C 'stream':189C 'strpos':172C 'subscrib':6A,52B,109C 'subscriber-level':108C 'substr':173C 'suppli':135C 'travers':40B,84C,177C 'upload':3A,26B,73C 'user':158C 'vanquish':2A,25B,72C 'vanupfi':44B,95C,157C 'verbatim':190C 'version':87C 'via':93C,191C 'vulner':81C 'wc':146C 'woocommerc':22B,29B,76C 'wordpress':1A,23B,30B,79C 'wp-config.php':62B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Vanquish Upload Files for WooCommerce plugin at version 2.7.13 or lower. The flaw needs an authenticated account with subscriber-level access, so sites that allow open registration or have untrusted users are most exposed. Sites without this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-122265':14A,17A '-2026':13A,16A 'arbitrari':9A 'cve':12A,15A 'file':4A,11A 'plugin':5A 'read':8A 'server':10A 'subscrib':6A 'upload':3A 'vanquish':2A 'wordpress':1A","search_b":"'2.7.13':36B 'arbitrari':55B 'credenti':67B 'databas':66B 'directori':39B 'expos':65B 'file':27B,45B,56B 'flaw':41B 'host':21B 'includ':35B 'log':50B 'logged-in':49B 'name':46B 'packag':18B 'paramet':47B 'plugin':31B 'read':54B 'secret':70B 'self':20B 'self-host':19B 'server':59B 'subscrib':52B 'travers':40B 'upload':26B 'vanquish':25B 'vanupfi':44B 'woocommerc':22B,29B 'wordpress':23B,30B 'wp-config.php':62B","search_c":"'/.pdf/../../../../wp-config.php':181C '2.7.13':92C 'access':111C,160C 'achiev':133C 'allow':175C 'arbitrari':119C 'attack':106C 'authent':105C 'author':130C 'branch':168C,186C 'bypass':131C 'caus':145C 'check':163C 'circuit':155C 'contain':126C 'content':117C 'directori':83C 'e.g':142C 'exist':139C 'fals':151C 'file':74C,96C,120C,162C 'get':147C 'id':141C 'includ':91C 'inform':128C 'level':110C 'loos':171C 'make':101C 'match':174C 'name':97C 'non':138C 'non-exist':137C 'order':140C,148C,161C 'paramet':98C,99C 'payload':178C 'pdf':143C,167C,185C 'plugin':77C 'possibl':103C 'read':115C 'readfil':192C 'return':150C 'satisfi':183C 'selector':169C 'sensit':127C 'server':123C 'short':154C 'short-circuit':153C 'stream':189C 'strpos':172C 'subscrib':109C 'subscriber-level':108C 'substr':173C 'suppli':135C 'travers':84C,177C 'upload':73C 'user':158C 'vanquish':72C 'vanupfi':95C,157C 'verbatim':190C 'version':87C 'via':93C,191C 'vulner':81C 'wc':146C 'woocommerc':76C 'wordpress':79C","first_public_at":"2026-11-07T07:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122265","severity":null,"published_at":"2026-11-07T07:17:04+00:00","modified_at":"2026-11-07T07:17:04+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","fetched_at":"2026-11-07T07:46:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}