CVE-2026-122265

Name of the Vulnerable Software and Affected Versions Vanquish Upload Files for WooCommerce versions prior to 2.7.14

Description An issue exists where authenticated users with subscriber-level access and above can read arbitrary files on the server. This is possible through a directory traversal flaw involving the vanupfi file name parameter. The flaw occurs because providing a non-existent order ID causes the wc get order() function to return false, bypassing the vanupfi user can access order files() authorization check. Additionally, a loose substring match in the is pdf() branch selector allows a traversal payload to be processed and streamed via the readfile() function.

Recommendations Update Vanquish Upload Files for WooCommerce to version 2.7.14 or later. As a temporary mitigation, restrict access to the vanupfi file name parameter for users with low-level privileges.