{"id":"CVE-2026-15323","kind":"vulnerability","aliases":["CVE-2026-15323"],"related":[],"title":"WordPress Lumise plugin: unauthenticated attackers read arbitrary server files","description":"The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumise_security nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials.","summary":"The Lumise Product Designer plugin for WooCommerce on WordPress has a directory traversal flaw in its process_checkout function in all versions up to and including 2.1.2. An unauthenticated attacker can read arbitrary files on the server, which may include sensitive configuration or credentials.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Lumise plugin version in the WordPress admin plugin list or the plugin's main file header; versions up to and including `2.1.2` are affected.\n- Look for the plugin directory `lumise` under `wp-content/plugins/` and confirm its version.","fix":"- Update the Lumise Product Designer plugin to a version newer than `2.1.2`; the fixed version is unknown from the sources.\n- If no fix is available, disable or remove the plugin until it is patched.","status":"open","published_at":"2026-10-28T06:16:36+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:21+00:00","updated_at":"2026-10-28T06:32:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T06:32:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Lumise Product Designer plugin to a version newer than `2.1.2`; the fixed version is unknown from the sources.\n- If no fix is available, disable or remove the plugin until it is patched.","reach":"internet","title":"WordPress Lumise plugin: unauthenticated attackers read arbitrary server files","impact":"medium","summary":"The Lumise Product Designer plugin for WooCommerce on WordPress has a directory traversal flaw in its process_checkout function in all versions up to and including 2.1.2. An unauthenticated attacker can read arbitrary files on the server, which may include sensitive configuration or credentials.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads arbitrary server files, including sensitive configuration data.","analyst_note":"Find the patched Lumise version and confirm the fix version from the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed Lumise plugin version in the WordPress admin plugin list or the plugin's main file header; versions up to and including `2.1.2` are affected.\n- Look for the plugin directory `lumise` under `wp-content/plugins/` and confirm its version.","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Lumise Product Designer for WooCommerce WordPress plugin at version 2.1.2 or older are exposed, because the vulnerable /?lumise=cart endpoint is reachable by any visitor and its nonce is publicly obtainable. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3419,"output_tokens":631,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-15323':12A,15A '-2026':11A,14A '2.1.2':48B,88C 'access':148C 'action':139C 'ajax':138C 'arbitrari':7A,54B,106C 'attack':5A,51B,100C 'cart':126C 'checkout':39B,92C 'configur':63B 'contain':113C 'content':104C 'credenti':65B,150C 'cve':10A,13A 'design':25B,68C 'directori':33B,79C 'endpoint':127C 'exploit':144C 'file':9A,55B,107C 'flaw':35B 'freeli':129C 'function':40B,93C 'handler':141C 'host':19B 'includ':47B,61B,87C 'inform':115C 'init':140C 'lumis':2A,23B,72C,117C,125C,137C 'make':95C,142C 'may':60B 'nonc':119C 'obtain':130C 'packag':16B 'plugin':3A,26B,73C 'possibl':97C 'prior':147C 'process':38B,91C 'product':24B,67C 'reach':122C 'read':6A,53B,102C 'requir':120C 'secur':118C 'self':18B 'self-host':17B 'sensit':62B,114C 'server':8A,58B,110C 'travers':34B,80C 'unauthent':4A,50B,99C,133C 'version':43B,83C 'via':89C,135C 'visitor':134C 'vulner':77C,124C 'woocommerc':20B,28B,70C 'wordpress':1A,21B,30B,71C,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Lumise Product Designer for WooCommerce WordPress plugin at version 2.1.2 or older are exposed, because the vulnerable /?lumise=cart endpoint is reachable by any visitor and its nonce is publicly obtainable. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15323","severity":null,"published_at":"2026-10-28T06:16:36+00:00","modified_at":"2026-10-28T06:16:36+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}