Live › vulnerability › CVE-2026-15323
Go to dashboardThe Lumise Product Designer plugin for WooCommerce on WordPress has a directory traversal flaw in its process_checkout function in all versions up to and including 2.1.2. An unauthenticated attacker can read arbitrary files on the server, which may include sensitive configuration or credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Lumise Product Designer for WooCommerce WordPress plugin at version 2.1.2 or older are exposed, because the vulnerable /?lumise=cart endpoint is reachable by any visitor and its nonce is publicly obtainable. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
2.1.2 are affected.lumise under wp-content/plugins/ and confirm its version.2.1.2; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumise_security nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-15323")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.