CVE-2026-49779: Path Traversal in Addify Tax Exempt for WooCommerce – Patch to v1.9.5

Technical summary

CVE-2026-49779 is a path traversal flaw (CWE-35) in the Tax Exempt for WooCommerce plugin that fails to properly validate or sanitize file path inputs. The vulnerability uses the '.../...//' pattern to bypass directory restrictions. The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible attack requiring low complexity and valid user credentials, with high confidentiality impact but no integrity or availability impact. The threat model assumes an authenticated attacker can submit crafted path sequences to access files outside the plugin's intended data directories.

Business impact

For WooCommerce store operators, this vulnerability could expose sensitive business data: customer tax exemption records, database configuration files, or private key material if improperly stored. Regulatory exposure exists if the path traversal leads to unauthorized access of personally identifiable information (PII) or payment card data. The requirement for authentication reduces the attack surface compared to unauthenticated path traversal, but customer or employee accounts compromised elsewhere could be leveraged to exploit this issue. Remediation is straightforward through a plugin update and carries minimal operational risk.

Affected systems

Addify Tax Exempt for WooCommerce versions before 1.9.5 are affected. Vendors_products data was not provided, so scope determination depends on your inventory. Any WooCommerce installation running this plugin in a version prior to 1.9.5 is at risk. Verify your installed version via the WordPress admin plugins dashboard or WP-CLI. This is a single-vendor, single-plugin vulnerability with no ecosystem-wide impact.

Exploitability

Exploitation requires valid user credentials to the WooCommerce site, significantly limiting casual opportunistic attacks. However, the authentication requirement is typically low-privileged (customer or subscriber accounts may be sufficient depending on plugin implementation). No known public exploits were indexed at the time of advisory publication, and the vulnerability is not tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack complexity is low once authenticated, making it attractive for targeted internal threats or accounts obtained through credential compromise.

Remediation

Upgrade Addify Tax Exempt for WooCommerce to version 1.9.5 or later. The update should be tested in a staging environment first, particularly if the plugin is integrated with custom WooCommerce workflows. Standard WordPress plugin update procedures apply: backup your database, disable other plugins if conflicts arise, and verify tax exemption functionality post-upgrade. No configuration changes are typically required.

Patch guidance

Visit your WordPress admin dashboard, navigate to Plugins > Installed Plugins, and click 'Update' on Tax Exempt for WooCommerce if a new version is available. Verify the installed version shows 1.9.5 or higher after the update completes. If automatic updates are disabled, manually download the latest version from the plugin repository and upload via SFTP or the WordPress plugin upload interface. For production sites with high transaction volume, schedule updates during low-traffic periods and maintain a backup you can quickly restore if needed.

Detection guidance

Audit access logs for suspicious file path patterns containing sequences like '../', '..\\', or percent-encoded variants (%2e%2e, %252e, etc.) in requests to the Tax Exempt plugin's processing endpoints. Monitor for file access patterns that read outside the wp-content/plugins/addify-tax-exempt/ directory. Log any failed file permission errors associated with the plugin. Intrusion detection rules can be tuned to flag path traversal attempts using standard IDS signatures. Once patched, this specific vector should not appear in logs.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this vulnerability warrants prompt remediation because: (1) it directly exposes sensitive tax and customer data, (2) the patch is low-risk and straightforward to deploy, (3) even one compromised customer or employee account could be exploited to access business-critical files, and (4) the remediation timeline is hours to days, not weeks. Prioritize this for sites handling PII or handling high-value transactions. Non-critical WooCommerce shops can remediate on the next scheduled maintenance window.

Risk score, explained

CVSS 3.1 assigns 6.5 (MEDIUM) due to: Network-accessible attack vector (AV:N), Low attack complexity requiring only valid credentials (AC:L), Login requirement (PR:L), no user interaction needed (UI:N), isolated scope (S:U), High confidentiality impact from file disclosure (C:H), and no direct integrity or availability impact (I:N, A:N). The score reflects that while confidentiality is compromised, the attack is not as severe as remote code execution or denial of service. The authentication requirement significantly reduces the effective CVSS compared to an unauthenticated path traversal.

Frequently asked questions