CVE-2026-49061 HIGH

CVE-2026-49061: WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability

Vendor Wpclever

Product WPC Product Options for WooCommerce

Weakness CWE-22 · Path traversal

Published June 15, 2026

Last update June 15, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WPC Product Options for WooCommerce versions up to 3.2.1 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can access sensitive files such as configuration files, database credentials, or other private data without needing to log in or interact with a user. This vulnerability requires only network access and can expose confidential information stored on the web server.

What an attacker can do

03Attacker Capabilities

Read arbitrary files from the server, including configuration and credential files.

Potential impact on your site

04Site Impact

Sensitive files (config, database credentials, private keys) may be exposed to unauthenticated attackers.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published

June 15, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-49061 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

Identifiers

CVE CVE-2026-49061

CWE CWE-22

CVSS 7.5 / HIGH

Affected versions