Arbitrary File Read in Woosa – Marktplaats for WooCommerce Plugin

CVE-2026-7547

What is CVE-2026-7547?

The Woosa – Marktplaats for WooCommerce plugin for WordPress has a vulnerability that allows authenticated users with Administrator access to exploit insufficient path sanitization in the render_logs_ui() function. This vulnerability arises when the plugin accepts a base64-encoded file name from the 'log_file' GET parameter and concatenates it with the log directory path. Without proper validation, attackers can manipulate this path to read sensitive files from the server, potentially exposing critical information such as the wp-config file.

References