Directory Traversal Vulnerability in AR for WooCommerce Plugin by WordPress

CVE-2026-14352

What is CVE-2026-14352?

The AR for WooCommerce plugin, affecting versions up to and including 8.40, is susceptible to a directory traversal vulnerability through the 'file' parameter. This issue allows unauthenticated attackers to access sensitive files on the server, which could lead to the exposure of confidential information. The failure of intended access controls exacerbates this risk. The nonce generation can be exploited by unauthorized users, the encryption key is predictably derived from the license key setting, and the Referer header can be easily manipulated. Remediation is advisable to mitigate potential impacts.

References