Unauthenticated File Deletion Vulnerability in ShopBuilder Pro - Elementor WooCommerce Builder Addons
CVE-2026-32477

8.6HIGH

Key Information:

Vendor

WordPress
Status
Shopbuilder Pro – Elementor WooCommerce Builder Addons
Vendor
CVE Published:
24 August 2026

What is CVE-2026-32477?

The ShopBuilder Pro plugin for Elementor WooCommerce Builder Addons, up to version 2.2.0, contains a vulnerability that allows unauthenticated users to delete arbitrary files from the server. This security flaw can lead to potential data loss and exploitation of the affected application. Site administrators are urged to update to the latest version to secure their installations against this vulnerability.

Affected Version(s)

ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0

References

https://patchstack.com/database/wordpress/plugin/shopbuil...
vdb-entry

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jamaal ahmed | Patchstack Bug Bounty Program
.