CVE-2026-122265vanquish83 Vanquish Upload Files for WooCommerce path traversal

What it is

A file name from the request can climb out of the intended folder with sequences like ../, reaching files the service never meant to expose.

How it is reached

An attacker can exploit it over the network, without an account, and nobody has to click anything. Success also depends on conditions the attacker does not fully control.

What an attacker gains

A successful attack can read the data it protects. In practice, this kind of flaw lets an attacker read or write files outside the folders the service meant to expose.

Is it being exploited?

There is no public report of exploitation yet.

What to do

1. No fixed version is listed yet. Find every place vanquish83 Vanquish Upload Files for WooCommerce runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, keep it off the internet or behind a VPN, allowlist or authenticating proxy.

Description from NVD

The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().