Description

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T15:17:01.790Z",
  "pubdate": "2026-08-18T15:17:01.790Z",
  "executiveSummary": "An unauthenticated arbitrary file download vulnerability has been identified in the Extra Product Options & Add-Ons for WooCommerce plugin affecting versions prior to 7.6. This security flaw enables remote, unauthenticated threat actors to retrieve arbitrary files from the underlying server filesystem, potentially exposing sensitive system configuration files, database credentials, application source code, and other restricted data.\nThe vulnerability poses a severe risk to confidentiality and overall system integrity, as successful exploitation does not require prior authentication or specialized privileges. The flaw resides within the input handling mechanisms of the affected plugin components, allowing direct traversal or retrieval sequences via network requests. Given the broad exposure of WordPress e-commerce plugins connected directly to the public internet, this vulnerability significantly increases the attack surface of vulnerable installations.\nMitigation requires immediate administrative action to update the Extra Product Options & Add-Ons for WooCommerce plugin to version 7.6 or higher, where the underlying input validation and file retrieval logic has been appropriately secured.",
  "technicalDetails": "The vulnerability is classified as an arbitrary file download flaw, stemming from insufficient input sanitization, path traversal prevention, and access control validation within the Extra Product Options & Add-Ons for WooCommerce plugin for versions < 7.6. Specifically, the vulnerable component fails to properly validate or restrict user-supplied parameters utilized in file retrieval routines.\nNetwork exposure is high, as the vulnerable functionality is accessible over HTTP/HTTPS to any unauthenticated remote attacker with network connectivity to the target WordPress instance. No pre-existing user accounts, session tokens, or high privileges are required to initiate or complete the exploitation vector.\nThe attack flow proceeds as follows: 1. The attacker identifies a target running a vulnerable version of Extra Product Options & Add-Ons for WooCommerce. 2. The attacker crafts a malicious HTTP request targeting the vulnerable parameter or endpoint responsible for handling file downloads or resource retrieval within the plugin. 3. The request incorporates directory traversal sequences (e.g., ../) or absolute paths to reference critical system files or application files outside the intended web root. 4. Due to the absence of robust path normalization and authorization checks, the application processes the input, accesses the requested filesystem resource, and returns its contents in the HTTP response body.\nPost-exploitation impact includes the potential extraction of sensitive files such as wp-config.php, which contains database connection strings and secret keys, as well as system files such as /etc/passwd depending on file system permissions and web server process privileges. This exposed data can facilitate further attacks, including database compromise, privilege escalation, or full system takeover."
}