Description

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site — not that the requested file path belongs to that product's configured downloads — making exploitation viable on any WooCommerce site with at least one such product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-10T04:17:45.967Z",
  "pubdate": "2026-09-10T04:17:45.967Z",
  "executiveSummary": "The Direct Download for WooCommerce plugin for WordPress, in all versions up to and including 1.19, is susceptible to a directory traversal vulnerability. This flaw allows unauthenticated remote attackers to access and read arbitrary files residing on the host server filesystem.\nThe vulnerability stems from improper validation of user-supplied input during the file inclusion process. Because the application fails to adequately constrain file access to authorized download directories, an attacker can traverse the directory structure to extract sensitive configuration files, such as wp-config.php, or other proprietary system data.\nExploitation is feasible on any WooCommerce installation that contains at least one free, virtual, downloadable product, as the authentication mechanism performs an insufficient ownership validation check. The system verifies the existence of any such product rather than confirming that the requested file path is associated with that specific product's legitimate configuration. This lack of strict authorization makes the system highly vulnerable, as it enables unauthorized disclosure of sensitive data without requiring administrative privileges or elevated access rights. The risk is critical, as successful exploitation facilitates unauthorized information disclosure, potentially leading to full site compromise.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of a file retrieval mechanism within the Direct Download for WooCommerce plugin. Specifically, the top-level include function processes input parameters used to identify downloadable files without performing proper sanitization or boundary checks against the path traversal characters (e.g., ../).\nThe vulnerability occurs because the plugin's logic for validating file access is fundamentally flawed. When a request is made to download a file, the system checks for the presence of a free, virtual, downloadable product to authorize the request. However, the logic fails to enforce an association between the specific product ownership and the requested file path. Instead, the presence of any valid free, virtual, downloadable product on the WooCommerce installation satisfies the condition, bypassing the intended security controls.\nAn unauthenticated attacker can exploit this flaw by supplying a crafted path in the URL parameters corresponding to the vulnerable function. By injecting sequences of directory traversal characters, an attacker can escape the intended web root or the designated download directory. The application, failing to canonicalize or restrict the path, subsequently includes and returns the contents of the target file to the user.\nThe attack flow is as follows: 1) The attacker identifies a target site running an affected version of the plugin with a valid free, virtual, downloadable product. 2) The attacker crafts a request containing a malicious path designed to traverse out of the plugin's directory. 3) The plugin validates the request by confirming the existence of a free, virtual, downloadable product, erroneously granting access. 4) The server processes the malicious path and returns the contents of the file located at that path to the attacker's HTTP response. 5) The attacker captures sensitive data, such as database credentials or environment variables, from the exposed files.\nThis vulnerability is classified as critical due to the lack of required authentication and the low barrier for exploitation. The attack is executable over the network without requiring any specialized privileges, provided the site meets the configuration requirements (the existence of at least one virtual product). Post-exploitation, the attacker gains the ability to read arbitrary files accessible to the web server process, which commonly includes sensitive PHP files, configuration files, and backups, leading to a complete compromise of the WordPress environment."
}