CVE-2026-120560realmag777 Active Woot Products Tables for WooCommerce. 100% FREE path traversal

What it is

A file name from the request can climb out of the intended folder with sequences like ../, reaching files the service never meant to expose.

How it is reached

An attacker can exploit it over the network, without an account, and nobody has to click anything.

What an attacker gains

The direct impact is limited: partial access to data or a partial outage. In practice, this kind of flaw lets an attacker read or write files outside the folders the service meant to expose.

Is it being exploited?

There is no public report of exploitation yet. It can be exploited automatically, at scale.

What to do

1. No fixed version is listed yet. Find every place realmag777 Active Woot Products Tables for WooCommerce. 100% FREE runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, keep it off the internet or behind a VPN, allowlist or authenticating proxy.

Description from NVD

The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the `get_table_data()` AJAX handler — registered for unauthenticated access via `wp_ajax_nopriv_woot_get_table_data` — performing no nonce verification and no capability check before passing the attacker-supplied `wp_columns_actions` parameter directly to `apply_filters()` alongside an attacker-controlled integer derived from the `table_id` parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads directory by supplying a known or guessed numeric attachment ID, enabling complete erasure of a site's media library. Exploitation is achievable because WordPress core registers `wp_delete_attachment()` as a callback on hooks such as `upgrader_scheduled_cleanup` and `importer_scheduled_cleanup`, which `sanitize_key()` does not strip; notably, only attachment posts reachable by numeric ID are affected, and files outside `wp-content/uploads` — such as `wp-config.php` or plugin PHP files — cannot be targeted through this path.