Arbitrary File Manipulation in Customer Area Plugin for WordPress

CVE-2026-3464

What is CVE-2026-3464?

The WP Customer Area plugin for WordPress is affected by a vulnerability that allows authenticated users, provided they have the necessary permissions, to read and delete files on the server. This is due to inadequate file path validation in the 'ajax_attach_file' function. Such access could expose confidential data contained in server files or lead to significant risks if critical files, such as wp-config.php, are deleted. Overall, this flaw raises serious security concerns for WordPress sites using this plugin, making it essential for administrators to update to safer versions to mitigate the risk.

References