CVE-2026-14955

Name of the Vulnerable Software and Affected Versions Checkout Field Editor for WooCommerce (Pro) versions prior to 3.7.8

Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Authenticated users with subscriber-level access or higher can exploit this by manipulating the thwcfe legacy file parameter to read arbitrary files on the server, potentially exposing sensitive information.

Recommendations Update Checkout Field Editor for WooCommerce (Pro) to version 3.7.8 or later. As a temporary mitigation, restrict access to the thwcfe legacy file parameter.