CVE-2026-22334 Overview
CVE-2026-22334 is an arbitrary file download vulnerability in the WooCommerce Book Price plugin for WordPress, affecting versions 1.3 and earlier. The flaw allows authenticated users with Subscriber-level privileges to download arbitrary files from the underlying server. The issue is categorized under [CWE-22] Path Traversal, where insufficient validation of user-supplied input enables access to files outside the intended directory. Successful exploitation exposes sensitive server-side data including configuration files, credentials, and source code. The vulnerability is network-exploitable with low attack complexity and requires no user interaction.
Critical Impact
Authenticated Subscribers can download arbitrary files from the WordPress host, exposing wp-config.php, database credentials, and other sensitive content.
Affected Products
- WooCommerce Book Price plugin for WordPress
- All versions up to and including 1.3
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2026-06-17 - CVE CVE-2026-22334 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-22334
Vulnerability Analysis
The WooCommerce Book Price plugin exposes a file download endpoint that accepts a file path or identifier from request parameters. The endpoint fails to sanitize traversal sequences such as ../ and does not constrain the resolved path to a designated download directory. Because the endpoint is reachable by any authenticated user, accounts with the lowest WordPress role, Subscriber, can invoke it. An attacker who registers on a site with open registration immediately gains the privileges needed to abuse the function.
The vulnerability falls under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The plugin returns the contents of the requested file with response headers that trigger a download. This converts a routine plugin feature into a file disclosure primitive.
Root Cause
The plugin trusts user-controlled input when constructing file paths and omits canonicalization checks. It does not verify that the resolved absolute path resides inside an allowed base directory before reading the file. The download handler also lacks capability checks beyond basic authentication, granting Subscribers the same access as higher-privileged roles.
Attack Vector
An attacker authenticates as a Subscriber, then issues an HTTP request to the vulnerable plugin endpoint with a manipulated file parameter containing directory traversal sequences. The server resolves the path, reads the target file, and streams it back. Common targets include wp-config.php for database credentials and authentication keys, .htaccess, log files, and backup archives left in the web root.
The vulnerability is described in prose only because no verified proof-of-concept code has been published. Refer to the Patchstack WooCommerce Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-22334
Indicators of Compromise
- HTTP requests to WooCommerce Book Price plugin endpoints containing ../, ..%2f, or encoded traversal sequences in query parameters
- Successful HTTP 200 responses returning content from sensitive files such as wp-config.php or /etc/passwd
- Unusual file download activity originating from low-privilege Subscriber accounts
- New Subscriber account registrations followed shortly by requests to plugin AJAX or admin-post handlers
Detection Strategies
- Inspect web server access logs for plugin URLs combined with path traversal patterns in parameters that name files
- Correlate authenticated session activity from Subscriber roles with file download responses larger than expected baselines
- Apply web application firewall signatures targeting directory traversal payloads against WordPress plugin endpoints
Monitoring Recommendations
- Monitor WordPress user_registered events and flag new Subscribers that interact with plugin endpoints within minutes of registration
- Alert on outbound responses from PHP handlers containing strings such as DB_PASSWORD, AUTH_KEY, or define( typical of wp-config.php
- Track HTTP 4xx/5xx anomalies and parameter fuzzing patterns against /wp-content/plugins/woo-book-price/ paths
How to Mitigate CVE-2026-22334
Immediate Actions Required
- Deactivate and remove the WooCommerce Book Price plugin until a patched version is verified by the vendor
- Disable open user registration or restrict the default new user role away from any account class that can access the plugin
- Rotate WordPress secret keys, database credentials, and any API tokens that may have resided in wp-config.php
- Audit existing Subscriber accounts and remove unrecognized registrations
Patch Information
No fixed version is referenced in the published advisory. Site operators should consult the Patchstack WooCommerce Vulnerability Report for vendor updates and remove the plugin if no patch is available.
Workarounds
- Block requests to the vulnerable plugin endpoints at the web application firewall layer using rules that reject traversal sequences
- Apply file system permissions that restrict the web server user from reading sensitive files outside the document root
- Move wp-config.php one directory above the web root where WordPress still loads it but direct file reads cannot reach it
# Example WAF rule snippet to block path traversal on the plugin path
# ModSecurity rule
SecRule REQUEST_URI "@contains /wp-content/plugins/woo-book-price/" \
"id:1002201,phase:2,deny,status:403,\
chain,msg:'Block traversal against Woo Book Price plugin'"
SecRule ARGS "@rx (\.\./|\.\.%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
