https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 22:09:07 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-122265 <p>The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the &#39;vanupfi_file_name&#39; parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., &#39;.pdf&#39;), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector&#39;s loose strpos() substring match allows a traversal payload such as &#39;../.pdf/../../../../wp-config.php&#39; to satisfy the PDF branch and be streamed verbatim via readfile().</p> <p>The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the &#39;vanupfi_file_name&#39; parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., &#39;.pdf&#39;), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector&#39;s loose strpos() substring match allows a traversal payload such as &#39;../.pdf/../../../../wp-config.php&#39; to satisfy the PDF branch and be streamed verbatim via readfile().</p> https://db.gcve.eu/vuln/fkie_cve-2026-122265 https://db.gcve.eu/vuln/ghsa-xw2r-p69h-9jmx <p>The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the &#39;vanupfi_file_name&#39; parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., &#39;.pdf&#39;), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector&#39;s loose strpos() substring match allows a traversal payload such as &#39;../.pdf/../../../../wp-config.php&#39; to satisfy the PDF branch and be streamed verbatim via readfile().</p> <p>The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the &#39;vanupfi_file_name&#39; parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., &#39;.pdf&#39;), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector&#39;s loose strpos() substring match allows a traversal payload such as &#39;../.pdf/../../../../wp-config.php&#39; to satisfy the PDF branch and be streamed verbatim via readfile().</p> https://db.gcve.eu/vuln/ghsa-xw2r-p69h-9jmx