CVE-2026-122265

The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().

• CWE-22

• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/File.php#L1055
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L277
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L284
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L294
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L644
• https://plugins.trac.wordpress.org/browser/vanquish-upload-files-for-woocommerce/tags/2.7.12/classes/com/Media.php#L882
• https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-woocommerce
• https://plugins.trac.wordpress.org/changeset/3785517/vanquish-upload-files-for-woocommerce/trunk/classes/com/Media.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/97977c09-b8e0-4ad3-8819-67d7bcff596a?source=cve

Published

Nov 7, 2026

Last Modified

Nov 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-122233FrankenPHP before 1.13.4 contains an information disclosure …3.7
• CVE-2026-122234jsondiffpatch before 0.7.7 contains a cross-site scripting v…4.7
• CVE-2026-122235Jan from 0.8.5 before 0.8.8 contains a workspace guard bypas…4.7
• CVE-2026-122236A vulnerability has been found in OpenHands up to 1.24.0. Th…6.3
• CVE-2026-12224The Dokan Pro plugin for WordPress is vulnerable to privileg…8.8
• CVE-2026-12225syracom AG Secure Login (2FA) for Atlassian Jira, Confluence…8.7
• CVE-2026-122266Improper isolation of shared resources in aws-network-policy…8.7
• CVE-2026-122267MinIO Signature V4 verification before RELEASE.2026-09-22T19…8.8
• CVE-2026-12227The Visual Composer Website Builder plugin for WordPress is …9.8
• CVE-2026-12228A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2026-122299Dulwich before 1.2.20 contains a commit object parsing vulne…8.8
• CVE-2026-1223PrismX MX100 AP controller developed by BROWAN COMMUNICATION…6.9