CVE-2026-73181: WooCommerce Path Traversal Vulnerability

CVE-2026-73181 Overview

CVE-2026-73181 is an unauthenticated arbitrary file download vulnerability in the Extra Product Options & Add-Ons for WooCommerce WordPress plugin. The flaw affects all versions prior to 7.6 and is classified as a path traversal weakness [CWE-22]. Remote attackers can retrieve arbitrary files from the underlying server without authentication or user interaction. Sensitive artifacts such as wp-config.php, private keys, and backup archives are exposed through this issue. Successful exploitation supports credential theft, secondary intrusion, and full site compromise.

Critical Impact
Unauthenticated remote attackers can download arbitrary files from vulnerable WooCommerce installations, exposing database credentials and secrets stored in wp-config.php.

Affected Products

Extra Product Options & Add-Ons for WooCommerce plugin versions prior to 7.6
WordPress sites running the woocommerce-tm-extra-product-options plugin
WooCommerce storefronts that expose the plugin's file-handling endpoints

Discovery Timeline

2026-08-18 - CVE-2026-73181 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73181

Vulnerability Analysis

The vulnerability is a path traversal weakness in the Extra Product Options & Add-Ons for WooCommerce plugin. An unauthenticated attacker crafts a request against a plugin endpoint that returns file contents. The endpoint accepts a user-controlled file path without validating that the target resides within an allowed directory. Attackers supply traversal sequences such as ../../ to escape the intended download directory. The server responds with the contents of the requested file, including sensitive configuration and secret material. The issue is remotely exploitable across the network with low attack complexity and requires no privileges.

Root Cause

The root cause is missing or insufficient validation of a filename parameter passed to a download handler. The plugin does not canonicalize the requested path or restrict access to a fixed base directory. It also fails to verify that the requester is authorized to retrieve the requested resource. These gaps together produce the [CWE-22] path traversal condition.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker sends a single crafted request to the vulnerable plugin endpoint from any internet-connected host. No account, session, or user interaction is required. The Exploit Prediction Scoring System (EPSS) probability is 0.481% with a 39.7 percentile rank as of 2026-08-21. Public exploit code is not currently listed in the enriched data, and CISA has not added this issue to the Known Exploited Vulnerabilities catalog.

The vulnerability is best described in prose because no verified proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-73181

Indicators of Compromise

Web server access logs containing traversal sequences such as ../ or URL-encoded variants %2e%2e%2f targeting plugin endpoints under wp-content/plugins/woocommerce-tm-extra-product-options/
Unexpected outbound HTTP responses containing contents of wp-config.php, .env, or SSH key files
Requests to plugin AJAX or admin-ajax handlers from unauthenticated sessions retrieving non-media file types

Detection Strategies

Deploy web application firewall rules that flag path traversal patterns in query strings and POST bodies targeting the plugin path
Correlate anonymous requests to plugin endpoints with large response sizes or non-standard content types
Baseline plugin request patterns and alert on deviations such as file paths outside the plugin's upload directory

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for retrospective hunting
Monitor filesystem access to wp-config.php and credential files by the PHP worker process
Alert on repeated 200 responses from plugin download endpoints originating from a single unauthenticated source

How to Mitigate CVE-2026-73181

Immediate Actions Required

Upgrade the Extra Product Options & Add-Ons for WooCommerce plugin to version 7.6 or later
Rotate all secrets stored in wp-config.php, including database credentials and authentication salts, if exploitation is suspected
Audit web server logs for traversal attempts against the plugin path since installation

Patch Information

The vendor addressed the vulnerability in version 7.6 of the plugin. Refer to the Patchstack Vulnerability Report for advisory details and fixed version confirmation.

Workarounds

Restrict access to the plugin's file-handling endpoints using web server rules or a web application firewall until the patch is applied
Disable the plugin if it is not actively required for store operations
Apply least-privilege filesystem permissions to the web server user to limit which files the PHP process can read

bash

# Configuration example - Nginx location block to block traversal attempts against the plugin
location ~* /wp-content/plugins/woocommerce-tm-extra-product-options/ {
    if ($args ~* "\.\.(/|%2f)") {
        return 403;
    }
}