CVE-2026-14352

Name of the Vulnerable Software and Affected Versions AR for WooCommerce versions prior to 8.41

Description The plugin is subject to Directory Traversal, allowing unauthenticated attackers to read arbitrary files on the server that may contain sensitive information. This is possible via the file parameter. The issue stems from the failure of three access controls: valid nonces are generated for unauthenticated users through the ar get fresh nonce and ar process user image AJAX handlers; the AES-256-CBC encryption key is predictable on default free installations because it is derived from get option('ar licence key'), which returns false; and the Referer header check is easily bypassed as it is controlled by the attacker.

Recommendations Update to a version newer than 8.40. As a temporary mitigation, restrict access to the file parameter to prevent unauthorized file reads.