{"affected":[{"defaultStatus":"unaffected","product":"Vanquish Upload Files for WooCommerce","source":"CNA: Wordfence","vendor":"vanquish83","versions":[{"lessThanOrEqual":"2.7.13","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-122265","cwes":["CWE-22"],"description":"The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794033578378,"publishedAt":1794033578378,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97977c09-b8e0-4ad3-8819-67d7bcff596a?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L644"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L277"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L284"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L294"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L882"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/File.php#L1055"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-woocommerce"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-woocommerce/trunk/classes/com/Media.php"}],"remediation":[],"revision":"2c525e53e2088d2f81157266032ff66525615f95752244556b2ad273661d73e3","sources":[{"modifiedAt":1794033578378,"name":"CNA: Wordfence","retrievedAt":1794035399412,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122265"}],"ssvc":null,"status":"published","title":"Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter","updatedAt":1794035399412}