CVE-2026-14955: WooCommerce Checkout Editor Path Traversal

CVE-2026-14955 Overview

CVE-2026-14955 affects the Checkout Field Editor for WooCommerce (Pro) plugin for WordPress. The vulnerability allows directory traversal through the thwcfe_legacy_file parameter in all versions up to and including 3.7.7. Authenticated attackers with subscriber-level access or above can read arbitrary files on the server. These files may include configuration data, credentials, and other sensitive information stored on the WordPress host.

The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Wordfence catalogued the vulnerability in its threat intelligence database.

Critical Impact
Authenticated users with minimal subscriber privileges can read arbitrary files, exposing WordPress configuration files such as wp-config.php that contain database credentials and secret keys.

Affected Products

Checkout Field Editor for WooCommerce (Pro) plugin for WordPress
All versions up to and including 3.7.7
Vendor: ThemeHigh

Discovery Timeline

2026-07-25 - CVE-2026-14955 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-14955

Vulnerability Analysis

The Checkout Field Editor for WooCommerce (Pro) plugin exposes a file-handling routine that accepts a user-controlled parameter named thwcfe_legacy_file. The plugin uses this parameter to reference a file path without adequately validating or sanitizing the input. An authenticated user can supply a relative path containing traversal sequences such as ../ to escape the intended directory. The server then reads and returns the contents of the referenced file.

Exploitation requires only subscriber-level access, a role that WordPress sites often grant through open registration. This significantly lowers the barrier to abuse compared to admin-only vulnerabilities. Successful exploitation compromises confidentiality but does not directly modify data or disrupt availability.

Root Cause

The root cause is insufficient input validation on the thwcfe_legacy_file parameter. The plugin does not restrict the parameter to an allowlist of expected files or normalize the path against a base directory. It also does not reject traversal sequences before reading the file from disk. This aligns with the CWE-22 weakness class.

Attack Vector

An attacker first authenticates to the target WordPress site as a subscriber or higher-privileged user. The attacker then sends a crafted request to the plugin endpoint that processes the thwcfe_legacy_file parameter. By supplying a path such as one referencing wp-config.php through parent-directory traversal, the attacker retrieves the file contents in the server response. See the Wordfence Vulnerability Analysis for additional technical detail.

No verified public exploit code is currently available for this vulnerability.

Detection Methods for CVE-2026-14955

Indicators of Compromise

Requests containing the thwcfe_legacy_file parameter with path traversal sequences such as ../, ..%2f, or encoded variants.
Web server access logs showing subscriber-authenticated sessions requesting the plugin endpoint with unusual file paths.
Outbound responses containing recognizable file headers from sensitive files such as wp-config.php or /etc/passwd.

Detection Strategies

Deploy web application firewall rules that inspect the thwcfe_legacy_file parameter and block traversal patterns.
Correlate WordPress authentication events with plugin file-access requests to flag anomalous read patterns from low-privilege accounts.
Review plugin request logs for parameter values referencing paths outside the plugin's expected directory.

Monitoring Recommendations

Enable verbose logging on the WordPress instance for authenticated plugin requests.
Monitor file access on sensitive files including wp-config.php, .htaccess, and files under /etc/.
Alert on newly registered subscriber accounts followed by plugin API interaction within a short time window.

How to Mitigate CVE-2026-14955

Immediate Actions Required

Update the Checkout Field Editor for WooCommerce (Pro) plugin to a version newer than 3.7.7 once released by ThemeHigh.
Audit WordPress user accounts and remove unnecessary subscriber-level accounts, particularly those created through open registration.
Rotate secrets stored in wp-config.php including database credentials and authentication keys if exposure is suspected.
Review web server access logs for prior exploitation attempts referencing the thwcfe_legacy_file parameter.

Patch Information

Refer to the ThemeHigh product page for the latest plugin release. Consult the Wordfence Vulnerability Analysis for patch status and version guidance.

Workarounds

Disable the Checkout Field Editor for WooCommerce (Pro) plugin until a patched version is applied.
Restrict WordPress registration to prevent unauthenticated users from obtaining subscriber accounts.
Deploy a web application firewall rule that blocks requests containing traversal sequences in the thwcfe_legacy_file parameter.
Apply file system permissions that limit the web server process's read access to only required WordPress files.

bash

# Example WAF rule pattern to block traversal in the vulnerable parameter
SecRule ARGS:thwcfe_legacy_file "@rx (\.\./|\.\.%2f|%2e%2e/)" \
    "id:1014955,phase:2,deny,status:403,\
     msg:'CVE-2026-14955 path traversal attempt in thwcfe_legacy_file'"