What the vulnerability does
01Description
The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook with no capability or nonce check, and passing the attacker-supplied csv_url POST parameter — filtered only by esc_url_raw() (which leaves absolute filesystem paths intact) and validate_file() (which only rejects '..' traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.
Explanation of Vulnerability in Simple Terms
02Summary
The Bulk Order Update for WooCommerce plugin versions 1.6 and earlier contains a path traversal vulnerability that allows unauthenticated attackers to read files from the server. An attacker can access sensitive files by manipulating file paths in requests to the plugin. This vulnerability requires no authentication or user interaction and affects the confidentiality of stored data.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server, including configuration files and other sensitive data.
Potential impact on your site
04Site Impact
Attackers can access sensitive files like wp-config.php, database backups, or private keys stored on the server.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 8, 2026
CVE published
July 8, 2026
Record updated
