Directory Traversal in WooCommerce Product Designer by Lumise Plugin for WordPress

CVE-2026-15323

What is CVE-2026-15323?

The Lumise plugin for WooCommerce on WordPress is susceptible to a Directory Traversal vulnerability via the process_checkout function, affecting all versions up to and including 2.1.2. This issue allows unauthenticated attackers to gain access to sensitive files on the server, potentially exposing confidential information. The vulnerability arises due to the lumise_security nonce being publicly accessible through the /?lumise=ajax action=init endpoint, facilitating exploit without any prior authentication or credentials.

References