CVE-2026-15019: WooCommerce Direct Download Path Traversal

CVE-2026-15019 Overview

The Direct Download for WooCommerce plugin for WordPress contains a directory traversal vulnerability affecting all versions up to and including 1.19. Unauthenticated attackers can read the contents of arbitrary files on the server by abusing a top-level include function that lacks proper path validation. The plugin's product ownership check only verifies that a free, virtual, downloadable product exists somewhere on the site rather than confirming the requested file path belongs to that product's configured downloads. This flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can read arbitrary files on any WooCommerce site running the plugin, exposing configuration files, credentials, and other sensitive server data.

Affected Products

Direct Download for WooCommerce plugin for WordPress (all versions ≤ 1.19)
WordPress sites running WooCommerce with at least one free, virtual, downloadable product
Hosting environments where the plugin is active and reachable over HTTP/HTTPS

Discovery Timeline

2026-09-10 - CVE-2026-15019 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-15019

Vulnerability Analysis

The vulnerability resides in the plugin's download handler, which processes an attacker-controlled file path parameter and passes it into a top-level include-style operation. Because the handler does not canonicalize or restrict the resolved path to the plugin's downloads directory, sequences such as ../ traverse out of the intended scope. An unauthenticated attacker can request paths that resolve to sensitive files elsewhere on the server, including wp-config.php, /etc/passwd, or application logs.

Exploitation impacts confidentiality directly, with no authentication or user interaction required. Since the vulnerability targets file read operations only, integrity and availability are not directly affected, but disclosed secrets frequently enable follow-on attacks such as database takeover or administrative account compromise.

Root Cause

The plugin performs an ownership check that only asserts the existence of any free, virtual, downloadable product on the WooCommerce store. It does not verify that the requested file path matches the downloadable files configured for that product. This logic gap decouples authorization from the object being accessed, allowing any file path supplied in the request to flow into the include operation.

Attack Vector

The attack vector is a crafted HTTP request to the plugin's public download endpoint. The attacker supplies a traversal payload in the parameter consumed by the vulnerable handler at direct-download.php and direct-download-for-woocommerce.php. See the WordPress Plugin Code Review at direct-download.php line 26 and the related handler at direct-download-for-woocommerce.php line 87 for the affected code paths. No verified public exploit code is available at the time of publication; refer to the Wordfence Vulnerability Report for additional technical context.

// No verified exploitation code available. Refer to vendor advisories
// for technical details on the vulnerable request pattern.

Detection Methods for CVE-2026-15019

Indicators of Compromise

HTTP requests to the Direct Download for WooCommerce endpoints containing ../, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths such as /etc/passwd or wp-config.php
Unexpected outbound responses containing WordPress configuration secrets, database credentials, or system file contents
Access log entries showing unauthenticated download requests referencing files outside the plugin's uploads directory

Detection Strategies

Inspect web server access logs for requests to plugin URLs carrying suspicious file, path, or download parameters with traversal patterns
Deploy web application firewall (WAF) rules that block encoded and unencoded directory traversal sequences targeting WordPress plugin endpoints
Correlate anonymous requests reading sensitive server files with subsequent authentication anomalies or credential reuse events

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, .env, and other secret-bearing files to alert on reconnaissance attempts
Forward WordPress and web server logs to a centralized analytics platform to hunt for traversal patterns across sites
Track plugin inventory across managed WordPress instances and alert when vulnerable versions (≤ 1.19) are present

How to Mitigate CVE-2026-15019

Immediate Actions Required

Update the Direct Download for WooCommerce plugin to a version above 1.19 once a patched release is available from the vendor
If no patched version is available, deactivate and remove the plugin until a fix is published
Rotate any secrets that may have been exposed, including database credentials, API keys, and WordPress salts stored in wp-config.php
Audit web server logs for prior exploitation attempts and preserve them for incident response

Patch Information

At the time of NVD publication (2026-09-10), all versions up to and including 1.19 are affected. Monitor the WordPress plugin repository and the Wordfence advisory for the fixed release version.

Workarounds

Restrict access to the vulnerable plugin endpoints at the web server or WAF layer until an official patch is deployed
Configure PHP open_basedir to constrain file access to the WordPress document root, limiting the scope of arbitrary reads
Remove or unpublish free, virtual, downloadable WooCommerce products to break the ownership-check precondition required for exploitation

bash

# Example nginx rule to block traversal payloads on plugin endpoints
location ~* /wp-content/plugins/direct-download-for-woocommerce/ {
    if ($args ~* "(\.\./|%2e%2e%2f|/etc/|wp-config)") {
        return 403;
    }
}