CVE-2026-32477: ShopBuilder Pro Path Traversal Vulnerability

CVE-2026-32477 Overview

CVE-2026-32477 is an unauthenticated arbitrary file deletion vulnerability in the ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin for WordPress. The flaw affects all plugin versions up to and including 2.2.0. Remote attackers can delete arbitrary files on the server without authentication or user interaction. Deleting critical files such as wp-config.php can force WordPress into a setup state, enabling site takeover. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated attackers can delete arbitrary files on WordPress servers running ShopBuilder Pro <= 2.2.0, leading to site denial of service and potential full site takeover.

Affected Products

ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin for WordPress
All versions up to and including 2.2.0
WordPress sites running WooCommerce with ShopBuilder Pro installed

Discovery Timeline

2026-08-24 - CVE-2026-32477 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-32477

Vulnerability Analysis

The vulnerability is a path traversal flaw that allows unauthenticated file deletion. The plugin exposes a file-handling operation that accepts a user-supplied file path without validating whether the path stays within an intended directory. Attackers submit crafted input containing directory traversal sequences such as ../ to reach files outside the plugin's working directory.

Because the endpoint requires no authentication, any remote user can trigger the deletion. Deleting core WordPress files such as wp-config.php triggers the WordPress installation flow, at which point an attacker can connect the site to an attacker-controlled database and effectively take over the installation. The scope is marked as changed because the impact reaches beyond the vulnerable plugin into the entire WordPress site.

Root Cause

The root cause is missing input sanitization and authorization on a file deletion routine. The plugin does not normalize the supplied path, does not confirm the resolved path resides within an allowed directory, and does not verify the caller's identity or capability. This combination maps directly to CWE-22.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax or plugin REST endpoint exposed by ShopBuilder Pro. An attacker sends an HTTP request containing a traversal payload targeting a sensitive file. No credentials or user interaction are required. See the Patchstack Vulnerability Report for full technical context.

No verified public proof-of-concept code is available at time of publication.

Detection Methods for CVE-2026-32477

Indicators of Compromise

Unexpected deletion of files under the WordPress installation, particularly wp-config.php, theme files, or plugin files
HTTP requests to admin-ajax.php or plugin REST routes containing ../ sequences or URL-encoded traversal patterns (%2e%2e%2f)
WordPress installation screen appearing on a previously configured site
Web server logs showing unauthenticated POST requests referencing ShopBuilder Pro AJAX actions

Detection Strategies

Inspect access logs for requests to ShopBuilder Pro endpoints paired with file path parameters containing traversal sequences
Alert on filesystem changes to WordPress core files using file integrity monitoring
Correlate 4xx/5xx responses on plugin endpoints followed by successful requests carrying suspicious file, path, or filename parameters

Monitoring Recommendations

Enable WordPress activity logging and forward events to a centralized log platform for retention and analysis
Monitor wp-content/plugins/shopbuilder-pro/ for unexpected modifications or removals
Track sudden appearance of a WordPress setup wizard on production hosts as a high-severity signal

How to Mitigate CVE-2026-32477

Immediate Actions Required

Update ShopBuilder Pro to a version later than 2.2.0 once a patched release is available from the vendor
If no patch is available, deactivate and remove the plugin from all WordPress installations
Audit the WordPress filesystem for missing or altered files and restore from known-good backups if tampering is detected
Rotate database credentials and WordPress secret keys if wp-config.php deletion is suspected

Patch Information

Refer to the Patchstack Vulnerability Report for the latest fixed version information and vendor advisory updates.

Workarounds

Deploy a web application firewall rule that blocks traversal patterns (../, %2e%2e%2f) in query and body parameters directed at ShopBuilder Pro endpoints
Restrict access to admin-ajax.php actions registered by the plugin using server-level access control until a patch is applied
Enforce filesystem permissions that prevent the web server user from deleting wp-config.php and other core files where operationally feasible

bash

# Example WAF rule pattern (ModSecurity) to block traversal on plugin endpoints
SecRule REQUEST_URI "@contains shopbuilder" \
  "chain,deny,status:403,id:1032477,msg:'CVE-2026-32477 traversal attempt'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2E%2E%2F)" "t:none,t:urlDecodeUni"