CVE-2026-14500: Arbitrary File Read in Bulk Order Update for WooCommerce Plugin

Technical summary

CVE-2026-14500 is a path traversal and arbitrary file read vulnerability in the Bulk Order Update for WooCommerce plugin (versions ≤1.6). The bouw_fetch_csv_data() AJAX handler is registered on the wp_ajax_nopriv_ hook, making it accessible to unauthenticated users. The handler accepts a csv_url POST parameter and passes it to fopen()/fgetcsv() after applying only esc_url_raw() and validate_file(). While esc_url_raw() converts characters, it preserves absolute filesystem paths like /etc/passwd; validate_file() only blocks '..' double-dot traversal, not absolute paths. The function reads and reflects the first parsed CSV line in a JSON response, enabling both file content disclosure and file-existence enumeration. The lack of nonce verification compounds the risk by allowing cross-site request forgery vectors.

Business impact

Attackers can extract sensitive configuration data—database credentials, API keys, salts, and security parameters stored in accessible PHP files—enabling account takeover, data exfiltration, or lateral movement into backend systems. The file-existence oracle aspect allows reconnaissance without immediate detection, enabling targeted follow-up attacks. For e-commerce operations, the integrity of CSV-based bulk orders could be undermined if attackers exfiltrate templates or modify processing logic. Reputational harm and regulatory exposure (PCI-DSS, GDPR) are possible if customer data or transaction records are exposed.

Affected systems

WordPress installations using the Bulk Order Update for WooCommerce plugin in version 1.6 and earlier are affected. The vulnerability is unauthenticated and requires no special configuration—any internet-facing WordPress site running a vulnerable version is exploitable. The attack surface includes all AJAX endpoints registered on wp_ajax_nopriv_, meaning the vulnerability is active as long as the plugin is installed, regardless of user role or site settings.

Exploitability

This vulnerability has low barriers to exploitation. No authentication is required, no user interaction is necessary, and the attack can be launched over the network with a simple HTTP POST request specifying a file path. The validation bypass using absolute filesystem paths is straightforward to discover and leverage. While the information leakage is limited to the first line of a file, that single line often contains critical data (e.g., configuration directives, SQL connection strings, or API credentials). Exploitation requires only basic web request construction—no sophisticated tooling or zero-day knowledge.

Remediation

Upgrade the Bulk Order Update for WooCommerce plugin to a version newer than 1.6 that addresses these validation weaknesses. The vendor should implement: (1) capability and permission checks (e.g., require manage_woocommerce capability and current_user_can() verification) on the AJAX handler; (2) nonce validation via wp_verify_nonce(); (3) a whitelist of allowed file paths or protocols rather than blocklist-based filtering; (4) rejection of absolute filesystem paths entirely; and (5) sandboxing of file reads to a designated upload directory only. Until patched, disable the plugin or restrict access via web application firewall rules.

Patch guidance

Check the plugin's changelog and GitHub repository for version 1.7 or later, which should address capability checks, nonce validation, and path filtering. Verify that the patched version no longer accepts absolute filesystem paths in the csv_url parameter and that file operations are restricted to the WordPress uploads directory. Test the patch in a staging environment before production rollout to confirm CSV upload functionality still works as intended. Monitor plugin update notifications and subscribe to security advisories from the plugin vendor.

Detection guidance

Monitor web server and application logs for POST requests to wp-admin/admin-ajax.php with action=bouw_fetch_csv_data and csv_url parameters containing file paths (absolute paths like /etc/passwd, sensitive config files like wp-config.php, or unusual protocol schemes). Alert on successful responses (HTTP 200) paired with these patterns, as they indicate potential exploitation attempts. File integrity monitoring on /etc/passwd and other system files can detect if an attacker has enumerated sensitive locations. WAF rules can block requests where csv_url contains non-http(s) schemes or absolute filesystem paths starting with /.

Why prioritize this

Although assigned a CVSS 3.1 score of 5.3 (MEDIUM), this vulnerability warrants prioritization because: (1) it requires zero authentication and zero user interaction; (2) it affects all installations without special configuration; (3) it enables both direct data theft and reconnaissance for follow-up attacks; (4) the affected plugin is actively maintained and likely widely deployed in e-commerce environments; (5) the information leaked (configuration, credentials, secrets) directly enables lateral movement and account compromise. Organizations running WordPress with WooCommerce should treat this as high-priority within their update cycles.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible, unauthenticated attack vector (AV:N, PR:N, UI:N) with low attack complexity (AC:L) and confidentiality impact (C:L), but no integrity or availability impact. The score appropriately captures the limited scope of information leakage (first line of a file) relative to full file read or system compromise. However, the real-world risk is amplified because the leaked data often contains high-value secrets; the file-existence oracle enables multi-stage attacks; and the ease of exploitation makes this a likely target for automated scanners. Security teams should consider context: a site storing database credentials in readable files faces higher practical risk than one with hardened environment configurations.

Frequently asked questions