CVE-2026-28171: WooCommerce File Approval Path Traversal

CVE-2026-28171 Overview

CVE-2026-28171 is an unauthenticated arbitrary file deletion vulnerability affecting the WooCommerce File Approval plugin for WordPress in versions 10.7 and earlier. The flaw is categorized under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). Remote attackers can delete arbitrary files on the underlying server without authentication or user interaction. Deletion of critical files such as wp-config.php can force WordPress into a re-installation state, enabling attacker-controlled site takeover.

Critical Impact
Unauthenticated attackers can remotely delete arbitrary files on affected WordPress installations, leading to site disruption and potential full site takeover through the WordPress setup workflow.

Affected Products

WordPress plugin: WooCommerce File Approval versions 10.7 and earlier
WordPress sites running WooCommerce with the File Approval plugin installed
Hosting environments where the WordPress process has delete permissions on adjacent files

Discovery Timeline

2026-08-24 - CVE-2026-28171 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-28171

Vulnerability Analysis

The WooCommerce File Approval plugin exposes a file-handling routine that accepts attacker-controlled input identifying a file to remove. The plugin fails to authenticate the requester and does not sanitize the supplied path. As a result, remote clients can trigger unlink() operations against arbitrary paths that the PHP process can access.

Because the vulnerable endpoint is reachable over the network and requires no privileges, exploitation is trivial to automate against exposed WordPress storefronts. The scope changes on successful exploitation, since impact extends beyond the plugin into the host WordPress application and its files.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin trusts a caller-supplied file identifier and passes it to a filesystem delete call without validating that the resolved path stays within an approved directory. It also omits capability checks and nonce verification that would restrict the action to authorized WooCommerce operators.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a path traversal payload referencing a target file. The plugin resolves the path and invokes deletion under the web server user. Deleting wp-config.php triggers WordPress to display the installation wizard on the next request, allowing an attacker to bind the site to an attacker-controlled database and gain administrative access.

No verified proof-of-concept code is published for this issue. See the Patchstack WooCommerce Vulnerability Report for advisory details.

Detection Methods for CVE-2026-28171

Indicators of Compromise

Unexpected absence of core WordPress files such as wp-config.php, .htaccess, or theme and plugin files.
WordPress presenting the installation wizard (/wp-admin/install.php) on a site that was previously configured.
HTTP requests to WooCommerce File Approval plugin endpoints containing ../ sequences or absolute file paths in parameters.
PHP error log entries referencing failed or successful unlink() calls originating from the plugin directory.

Detection Strategies

Inspect web server access logs for unauthenticated POST or GET requests targeting endpoints under /wp-content/plugins/woocommerce-file-approval/ or admin-ajax.php actions registered by the plugin.
Alert on path traversal patterns such as ../, URL-encoded %2e%2e%2f, or references to wp-config.php in request parameters.
Correlate file deletion events on the WordPress document root with preceding HTTP requests to identify exploitation attempts.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress root, wp-content, and wp-includes directories to detect unauthorized deletions.
Forward web server, PHP, and WordPress logs to a centralized analytics platform for retention and correlation.
Monitor for the sudden reappearance of the WordPress installer route, which indicates that wp-config.php was removed.

How to Mitigate CVE-2026-28171

Immediate Actions Required

Deactivate the WooCommerce File Approval plugin on affected WordPress sites until a fixed version is installed.
Restrict access to WordPress administrative and AJAX endpoints at the web application firewall or reverse proxy layer.
Verify integrity of wp-config.php and other core files, and restore from known-good backups if tampering is suspected.

Patch Information

At the time of publication, refer to the Patchstack WooCommerce Vulnerability Report for vendor fix status. Upgrade to a version later than 10.7 once released by the plugin author, and validate the update in a staging environment before deploying to production.

Workarounds

Block unauthenticated access to the plugin's AJAX and REST endpoints using a web application firewall rule that denies requests lacking a valid WordPress session cookie.
Add WAF signatures that reject requests containing path traversal sequences (../, %2e%2e%2f) targeting WooCommerce File Approval routes.
Set filesystem permissions so that the PHP process cannot delete wp-config.php or files outside the plugin's designated upload directory.
Take an offline backup of the WordPress database and files before applying mitigations to enable rapid recovery.

bash

# Example WAF rule (ModSecurity) blocking traversal against the vulnerable plugin
SecRule REQUEST_URI "@contains woocommerce-file-approval" \
  "chain,id:1002026,phase:2,deny,status:403,log,msg:'CVE-2026-28171 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|wp-config\.php)" "t:lowercase,t:urlDecodeUni"