Directory Traversal Vulnerability in AR for WordPress Plugin by WordPress

CVE-2026-14327

What is CVE-2026-14327?

The AR for WordPress plugin is affected by a directory traversal vulnerability that allows unauthenticated attackers to access arbitrary files on the server through the 'file' parameter. Attackers can potentially read sensitive information by exploiting unsecured AJAX handlers available in the plugin. To execute this attack, the adversary must first obtain a valid nonce and leverage certain public handlers, which can be easily done on a default or unlicensed installation where the license key remains unset. This results in significant security risks for installations of the plugin, emphasizing the need for prompt updates and mitigations.

References