CVE-2026-7547: Path Traversal in Woosa Marktplaats WooCommerce Plugin – Admin File Read Risk

Technical summary

CVE-2026-7547 is a Path Traversal vulnerability (CWE-22) in the Woosa – Marktplaats for WooCommerce plugin versions up to 2.0.4. The render_logs_ui() function accepts a base64-encoded file name via the 'log_file' GET parameter and concatenates it directly to the plugin's log directory path without path canonicalization or boundary validation. This allows an authenticated administrator to traverse upward in the directory tree and read arbitrary files. The CVSS 3.1 score of 4.9 (MEDIUM) reflects the requirement for authenticated Administrator-level access, though the impact on confidentiality is high.

Business impact

If an administrator account is compromised or an insider has malicious intent, they can extract the WordPress database credentials, API keys, and other secrets from wp-config.php. This could facilitate further lateral movement, data exfiltration, or credential harvesting. For multi-tenant or managed WordPress hosting environments, this escalates risk significantly. The business impact depends on defense-in-depth controls: if admin access is already granted, the threat surface is narrower, but the confidentiality breach is severe.

Affected systems

WordPress installations running the Woosa – Marktplaats for WooCommerce plugin in any version up to and including 2.0.4. This plugin is designed for integration with Marktplaats, a Dutch online marketplace. The vulnerability requires administrator-level authentication, so only sites with compromised or rogue admin accounts are at immediate risk.

Exploitability

The vulnerability requires Administrator-level access to WordPress, making opportunistic exploitation unlikely for external threat actors. However, the attack is trivial to execute once admin credentials are obtained: base64-encode a traversal path like '../../../../wp-config.php', pass it as the 'log_file' parameter, and retrieve the file contents. No user interaction is required. Insider threats or accounts compromised through phishing, credential stuffing, or weak passwords present the principal risk vector.

Remediation

Update the Woosa – Marktplaats for WooCommerce plugin to a version that implements proper path sanitization and validates that the decoded and resolved file path remains within the intended log directory. Verify the patched version against the vendor's advisory. Additionally, enforce strong password policies for administrator accounts, implement two-factor authentication (2FA), and restrict admin account creation to trusted personnel only.

Patch guidance

Check the Woosa plugin's official update mechanism in the WordPress admin dashboard or the WordPress plugin repository for a patched version addressing CVE-2026-7547. Verify against the vendor's official security advisory to confirm the fix includes canonical path resolution and strict boundary validation. After patching, test that the log file viewer functions normally and that path traversal attempts are blocked.

Detection guidance

Monitor web server and WordPress logs for GET requests to the plugin's render_logs_ui endpoint containing suspicious 'log_file' parameters, particularly those with base64-encoded traversal sequences (e.g., ../ patterns after decoding). Audit recent administrator account logins and privilege escalations. Review file access logs for unexpected reads of wp-config.php or other sensitive files by the web server process. Implement WAF rules to block requests with path traversal indicators in plugin parameters.

Why prioritize this

Although the CVSS score is MEDIUM (4.9), the practical risk is context-dependent. If your WordPress admin accounts are well-protected and monitored, remediation can follow standard patching windows. However, if admin accounts have been reused, shared, or are accessed from untrusted networks, this should be elevated to high priority, as the confidentiality impact is severe and file contents are directly exfiltrable without additional exploitation steps.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H), no user interaction (UI:N), and unchanged scope (S:U). The confidentiality impact is high (C:H), but integrity and availability are not affected (I:N, A:N). The high privilege barrier and absence from the Known Exploited Vulnerabilities (KEV) catalog keep the score in the MEDIUM band, but organizations should not underestimate the risk if admin credentials are at risk.

Frequently asked questions