{"id":"CVE-2026-125780","kind":"vulnerability","aliases":["CVE-2026-125780"],"related":[],"title":"WooCommerce Custom Product Addons Pro: path traversal flaw exposes server files","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This issue affects Woocommerce Custom Product Addons Pro: from n/a through 5.9.0.","summary":"The WooCommerce Custom Product Addons Pro plugin by Acowebs has a path traversal flaw that lets a user reach files outside the directory the plugin intends. Per the NVD entry, versions through 5.9.0 are affected; the sources do not say what an attacker can read or change.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"woo-custom-product-addons-pro","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WooCommerce Custom Product Addons Pro plugin (woo-custom-product-addons-pro) is installed and read its version in the plugin list or main plugin file header","fix":"- Versions after `5.9.0` are implied as fixed by the affected range; the sources do not name the exact fixed release","status":"open","published_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:22+00:00","updated_at":"2026-11-15T14:37:22+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-15T14:37:22Z","model":"claude-haiku-5-5","output":{"fix":"- Versions after `5.9.0` are implied as fixed by the affected range; the sources do not name the exact fixed release\n- unknown for the exact fixed version","reach":"internet","title":"WooCommerce Custom Product Addons Pro: path traversal flaw exposes server files","impact":"medium","summary":"The WooCommerce Custom Product Addons Pro plugin by Acowebs has a path traversal flaw that lets a user reach files outside the directory the plugin intends. Per the NVD entry, versions through 5.9.0 are affected; the sources do not say what an attacker can read or change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown file access on the web server, depending on the flaw","analyst_note":"Find the vendor advisory or the NVD CNA detail to confirm the fixed version, the vulnerable endpoint, and whether authentication is required.","how_to_check":"- Check whether the WooCommerce Custom Product Addons Pro plugin (woo-custom-product-addons-pro) is installed and read its version in the plugin list or main plugin file header\n- unknown for anything beyond that; the sources do not say which endpoint or setting is involved","plain_action":"","product_name":"woo-custom-product-addons-pro","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the WooCommerce Custom Product Addons Pro plugin at version 5.9.0 or earlier are in the affected range. The sources do not say which request path or setting makes the flaw reachable, or whether authentication is needed, so teams should look at the plugin's upload and file-handling features first.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000798,"input_tokens":4580,"output_tokens":679,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125780':14A,17A '-2026':13A,16A '5.9.0':62B,115C 'acoweb':38B,90C 'addon':4A,34B,94C,100C,110C 'addons':22A 'affect':64B,106C 'allow':102C 'attack':72B 'chang':76B 'custom':2A,20A,32B,92C,98C,108C 'cve':12A,15A 'directori':52B,85C 'entri':59B 'expos':9A 'file':11A,49B 'flaw':8A,43B 'host':27B 'improp':77C 'intend':55B 'issu':105C 'let':45B 'limit':78C 'n/a':113C 'nvd':58B 'outsid':50B 'packag':24B 'path':6A,41B,86C,103C 'pathnam':81C 'per':56B 'plugin':36B,54B 'pro':5A,23A,35B,95C,101C,111C 'product':3A,21A,33B,93C,99C,109C 'reach':48B 'read':74B 'restrict':84C 'say':69B 'self':26B 'self-host':25B 'server':10A 'sourc':66B 'travers':7A,42B,87C 'traversal.this':104C 'user':47B 'version':60B 'vulner':88C 'woo':19A,97C 'woo-custom-product-addons-pro':18A,96C 'woocommerc':1A,28B,31B,91C,107C 'wordpress':29B","nicknames":[],"mitigations":[],"who_affected":"Stores running the WooCommerce Custom Product Addons Pro plugin at version 5.9.0 or earlier are in the affected range. The sources do not say which request path or setting makes the flaw reachable, or whether authentication is needed, so teams should look at the plugin's upload and file-handling features first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["woocustomproductaddonspro"],"ptokens":["addons","custom","pro","product","woo"],"labels":["high","package","selfhosted","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-125780':14A,17A '-2026':13A,16A 'addon':4A 'addons':22A 'custom':2A,20A 'cve':12A,15A 'expos':9A 'file':11A 'flaw':8A 'path':6A 'pro':5A,23A 'product':3A,21A 'server':10A 'travers':7A 'woo':19A 'woo-custom-product-addons-pro':18A 'woocommerc':1A","search_b":"'5.9.0':62B 'acoweb':38B 'addon':34B 'affect':64B 'attack':72B 'chang':76B 'custom':32B 'directori':52B 'entri':59B 'file':49B 'flaw':43B 'host':27B 'intend':55B 'let':45B 'nvd':58B 'outsid':50B 'packag':24B 'path':41B 'per':56B 'plugin':36B,54B 'pro':35B 'product':33B 'reach':48B 'read':74B 'say':69B 'self':26B 'self-host':25B 'sourc':66B 'travers':42B 'user':47B 'version':60B 'woocommerc':28B,31B 'wordpress':29B","search_c":"'5.9.0':115C 'acoweb':90C 'addon':94C,100C,110C 'affect':106C 'allow':102C 'custom':92C,98C,108C 'directori':85C 'improp':77C 'issu':105C 'limit':78C 'n/a':113C 'path':86C,103C 'pathnam':81C 'pro':95C,101C,111C 'product':93C,99C,109C 'restrict':84C 'travers':87C 'traversal.this':104C 'vulner':88C 'woo':97C 'woo-custom-product-addons-pro':96C 'woocommerc':91C,107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125780","severity":null,"published_at":"2026-11-15T14:17:25+00:00","modified_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}