Directory Traversal Vulnerability in Vanquish Upload Files for WooCommerce by WordPress

CVE-2026-122265

What is CVE-2026-122265?

The Vanquish Upload Files for WooCommerce plugin for WordPress contains a Directory Traversal vulnerability that allows authenticated users with subscriber-level access and above to access arbitrary files on the server. By manipulating the 'vanupfi_file_name' parameter with a non-existent order ID, attackers can bypass authorization checks, enabling them to read sensitive files such as wp-config.php. This exploitation occurs due to a flaw in the file access logic, where loose string matching permits traversal payloads, posing a significant risk of sensitive data exposure.

References