CVE-2026-122265
Description
The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().
References
- https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/File.php#L1055
- https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L277
- https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L284
- https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L294
- https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L644