WooCommerce AR Plugin Directory Traversal via Unauthenticated File Access

The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is derived from get_option('ar_licence_key'), which returns false on default free installations and yields a predictable key attackers can use to encrypt their own path payloads; and the Referer check is trivially bypassed because the Referer header is attacker-controlled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 347matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The AR for WooCommerce plugin contains a critical directory traversal vulnerability (CWE-22) that allows unauthenticated attackers to read arbitrary files from affected servers. This vulnerability affects all versions up to 8.40 and is particularly dangerous because three separate access controls fail simultaneously: nonce validation is broken since unauthenticated users can freely mint valid nonces through the nopriv AJAX handlers (ar_get_fresh_nonce and ar_process_user_image), enabling attackers to bypass CSRF protections entirely. Any WordPress site running this plugin exposes sensitive server files—including configuration files, database credentials, and private keys—to anonymous read access. Given the widespread use of WooCommerce in e-commerce environments, this vulnerability threatens thousands of online stores with immediate information disclosure.

Casky's 347 mapped skills detect the attack patterns underlying this CVE across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would observe detection patterns for: (1) Exploitation (TA0001) — suspicious AJAX requests to ar_get_fresh_nonce and ar_process_user_image endpoints from unauthenticated sources without valid WordPress user roles, (2) Discovery (TA0007) — enumeration of file paths using directory traversal sequences (../ patterns) in the 'file' parameter, and (3) Resource Development — reconnaissance of server structure through repeated file access attempts targeting common sensitive locations (/wp-config.php, .env, /etc/passwd equivalents). The extended reasoning capabilities identify the distinctive pattern of nonce reuse across multiple requests and the mismatch between expected WordPress capability checks and actual enforcement, surfacing the broken access control chain that makes this vulnerability exploitable at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

347 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14352.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-14352

Casky has 347 skills that investigate the attack patterns behind CVE-2026-14352. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn