CVE-2026-14327

Name of the Vulnerable Software and Affected Versions AR for WordPress versions prior to 8.41

Description An unauthenticated directory traversal flaw exists in the file handling logic of the plugin. The issue occurs when the public AJAX functionality accepts a user-controlled file parameter without proper input validation or path sanitization, allowing traversal sequences to escape intended directories and read arbitrary server-side files. This can expose sensitive data such as database credentials in wp-config.php and API keys. To exploit this, an attacker must obtain a valid nonce and secure nonce via the ar get fresh nonce and ar process user image nopriv AJAX handlers and reproduce the encryption key locally, which is possible on default free or unlicensed installations where ar licence key is unset.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.