CVE-2026-14500: WooCommerce Plugin File Read Vulnerability

CVE-2026-14500 Overview

CVE-2026-14500 is an unauthenticated arbitrary file read vulnerability in the Bulk Order Update for WooCommerce plugin for WordPress, affecting versions up to and including 1.6. The flaw resides in the bouw_fetch_csv_data() AJAX handler, which is registered on the wp_ajax_nopriv_ hook without any capability or nonce checks. An attacker-supplied csv_url POST parameter flows into fopen() and fgetcsv(), and the first parsed line is reflected back in the JSON response. This allows remote, unauthenticated attackers to read the first line of arbitrary files on the server and to use the handler as a file-existence oracle [CWE-22].

Critical Impact
Unauthenticated attackers can read the first line of arbitrary files such as /etc/passwd and enumerate filesystem contents on any WordPress site running the vulnerable plugin.

Affected Products

Bulk Order Update for WooCommerce plugin for WordPress — versions up to and including 1.6
WordPress installations exposing the plugin's wp_ajax_nopriv_ endpoint
WooCommerce-based e-commerce sites using this plugin

Discovery Timeline

2026-07-08 - CVE-2026-14500 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14500

Vulnerability Analysis

The vulnerability is a path traversal and arbitrary file read weakness in an AJAX handler intended to import CSV order data. Because the handler is exposed via wp_ajax_nopriv_, WordPress serves it to unauthenticated visitors. Attackers submit a crafted csv_url value pointing to a local filesystem path, and the plugin opens the file with fopen() and parses it with fgetcsv(). The first parsed line is echoed back inside the JSON response, disclosing file contents. When the file does not exist or cannot be opened, the response differs, giving the attacker a reliable oracle to enumerate files and directories on the host.

Root Cause

Input validation on csv_url relies on two insufficient controls. esc_url_raw() sanitizes URL characters but preserves absolute filesystem paths such as /etc/passwd. validate_file() rejects only .. traversal patterns and does not block absolute paths. Neither function enforces a URL scheme, hostname allowlist, or file type restriction. Combined with the missing capability check and missing nonce verification, the handler treats any client-controlled string as a valid input to fopen().

Attack Vector

An attacker sends a POST request to wp-admin/admin-ajax.php with action=bouw_fetch_csv_data and csv_url set to an absolute path on the server, for example /etc/passwd or /var/www/html/wp-config.php. No authentication, session, or nonce is required. The plugin opens the target file, parses the first line with fgetcsv(), and returns that line in the JSON response body. Attackers iterate through candidate paths to enumerate installed software, read configuration snippets, and identify system users.

See the Wordfence Vulnerability Report and the WordPress plugin source for the exact handler implementation.

Detection Methods for CVE-2026-14500

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=bouw_fetch_csv_data from unauthenticated sessions.
csv_url parameter values containing absolute filesystem paths such as /etc/passwd, /etc/hosts, or wp-config.php.
JSON responses from admin-ajax.php containing fragments of system file contents like root:x:0:0.
Repeated requests from the same source enumerating varying file paths, indicative of oracle-based reconnaissance.

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php with the bouw_fetch_csv_data action.
Alert on any csv_url value that begins with /, \, or a drive letter rather than http:// or https://.
Correlate high-volume admin-ajax.php requests from a single client IP with varying csv_url values to detect enumeration.
Deploy Web Application Firewall (WAF) rules to block absolute path patterns in the csv_url parameter.

Monitoring Recommendations

Enable verbose logging on WordPress AJAX endpoints and forward logs to a centralized SIEM for correlation.
Monitor filesystem access patterns on the web server user account for reads of sensitive files outside the web root.
Track plugin inventory across WordPress deployments and flag any host running Bulk Order Update for WooCommerce ≤ 1.6.

How to Mitigate CVE-2026-14500

Immediate Actions Required

Update the Bulk Order Update for WooCommerce plugin to a version above 1.6 as soon as a patched release is available.
If no fixed version is available, deactivate and remove the plugin from all WordPress installations.
Review web server access logs for prior exploitation attempts targeting the bouw_fetch_csv_data action.
Rotate any secrets, database credentials, or API keys that may have appeared in the first line of readable configuration files.

Patch Information

At the time of publication, the NVD entry for CVE-2026-14500 does not list a fixed version. Consult the Wordfence Vulnerability Report and the plugin's WordPress.org listing for the latest release status. Apply the vendor patch as soon as it is published.

Workarounds

Block requests to /wp-admin/admin-ajax.php where the action parameter equals bouw_fetch_csv_data at the WAF or reverse proxy layer.
Restrict access to admin-ajax.php from untrusted networks where feasible, or require authentication for the affected action via a mu-plugin override.
Deny read access to sensitive files such as /etc/passwd and wp-config.php from the web server user via filesystem permissions and open_basedir restrictions.

bash

# Example nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "bouw_fetch_csv_data") { return 403; }
    if ($request_body ~* "action=bouw_fetch_csv_data") { return 403; }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}