CVE-2026-15019

Name of the Vulnerable Software and Affected Versions Direct Download for WooCommerce versions prior to 1.20

Description A Directory Traversal issue exists in the (top-level include) function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. The flaw occurs because the product ownership check only verifies the existence of a free, virtual, downloadable product on the site, rather than confirming that the requested file path is associated with that specific product's downloads.

Recommendations Update the plugin to version 1.20 or later.