CVE-2026-14500 – Bulk Order Update for WooCommerce

CVE ID :CVE-2026-14500

Published : July 8, 2026, 5:34 a.m. | 14 minutes ago

Description :The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook with no capability or nonce check, and passing the attacker-supplied csv_url POST parameter — filtered only by esc_url_raw() (which leaves absolute filesystem paths intact) and validate_file() (which only rejects ‘..’ traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…