CVE-2026-14352: AR for WooCommerce Path Traversal Flaw

CVE-2026-14352 Overview

The AR for WooCommerce plugin for WordPress contains a directory traversal vulnerability affecting all versions up to and including 8.40. Unauthenticated attackers can exploit the file parameter to read arbitrary files on the server. The flaw stems from three failed access controls in the plugin's secure download handler. Attackers can mint valid nonces through unauthenticated AJAX endpoints, derive the encryption key from a predictable default value, and spoof the Referer header. Successful exploitation exposes sensitive configuration files, credentials, and application source code. This vulnerability is classified under CWE-22.

Critical Impact
Unauthenticated remote attackers can read arbitrary files including wp-config.php, exposing database credentials, authentication keys, and other sensitive server contents.

Affected Products

AR for WooCommerce plugin for WordPress — all versions up to and including 8.40
Fixed in version 8.41
WordPress sites running the plugin with default free-tier configuration are most exposed

Discovery Timeline

2026-07-03 - CVE-2026-14352 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14352

Vulnerability Analysis

The vulnerability exists in the ar-secure-download.php handler of the AR for WooCommerce plugin. The file parameter accepts a path payload that is decrypted and passed to file read operations without normalization or containment checks. Attackers craft path sequences such as ../../../../wp-config.php to escape the intended download directory. The plugin exposes the download endpoint over the network and requires no authentication or user interaction.

Root Cause

Three layered access controls fail simultaneously. First, the ar_get_fresh_nonce and ar_process_user_image AJAX handlers are registered under the wp_ajax_nopriv_ hook, allowing unauthenticated callers to mint valid nonces on demand. Second, the AES-256-CBC key is derived from get_option('ar_licence_key'), which returns false on default free installations. This produces a deterministic, predictable key that attackers can reproduce locally to encrypt their own traversal payloads. Third, the Referer check accepts any header value the attacker supplies, offering no security boundary.

Attack Vector

An attacker first calls the nopriv AJAX endpoint to obtain a fresh nonce. The attacker then encrypts a directory traversal payload targeting sensitive files using the predictable AES key derived from the empty license option. The encrypted file parameter is submitted to the secure download handler along with a spoofed Referer header. The server decrypts the path, resolves the traversal sequences, and returns the target file contents in the HTTP response.

See the Wordfence Vulnerability Report and the WordPress Change Set for the vulnerable code paths and remediation diff.

Detection Methods for CVE-2026-14352

Indicators of Compromise

HTTP requests to admin-ajax.php with action=ar_get_fresh_nonce or action=ar_process_user_image from unauthenticated sources
Requests to the AR secure download endpoint containing base64-encoded file parameters followed by outbound responses of unusual size
Access logs showing sequential retrieval of wp-config.php, .htaccess, or files under /etc/ shortly after nonce minting requests
Unexpected Referer header values that do not match the site's canonical hostname

Detection Strategies

Alert on unauthenticated POST requests to wp_ajax_nopriv_ar_get_fresh_nonce and wp_ajax_nopriv_ar_process_user_image handlers
Inspect decrypted file parameters for path traversal sequences including ../, ..\, URL-encoded variants, and absolute paths
Correlate nonce generation events with subsequent file download requests from the same source IP within short time windows
Deploy WordPress-aware WAF rules that block known traversal patterns targeting the AR for WooCommerce download endpoint

Monitoring Recommendations

Enable verbose logging on the web server layer to capture full request URIs and parameter values for the plugin's endpoints
Monitor filesystem access for reads of wp-config.php originating from the PHP-FPM process outside expected administrative workflows
Track outbound response sizes on plugin endpoints to identify anomalous data exfiltration volumes

How to Mitigate CVE-2026-14352

Immediate Actions Required

Update the AR for WooCommerce plugin to version 8.41 or later immediately
Rotate all secrets stored in wp-config.php including database credentials, AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values
Audit web server access logs for prior exploitation attempts targeting the plugin's AJAX and download endpoints
Review WordPress user accounts and API keys for signs of unauthorized activity following potential credential exposure

Patch Information

The vendor addressed the vulnerability in version 8.41. Review the WordPress Version Update diff and the secure download handler changeset for the exact code changes applied by the maintainer.

Workarounds

Deactivate and remove the AR for WooCommerce plugin if immediate patching is not possible
Apply a WAF rule that blocks requests to the plugin's secure download endpoint containing traversal patterns in the file parameter
Restrict access to admin-ajax.php nopriv actions associated with the plugin via web server ACLs until the update is applied
Enforce filesystem permissions so the PHP process cannot read sensitive files outside the WordPress document root where feasible

bash

# Example nginx rule to block traversal patterns on the plugin endpoint
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^ar_(get_fresh_nonce|process_user_image|secure_download)$") {
        if ($args ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
            return 403;
        }
    }
}