CVE-2026-16777CWE-22path-traversal

CVE-2026-16777

Medium · published September 18, 2026

CVSS v3.1
4.9
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00657 · 50.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-18T12:17Z
References (6)
https://plugins.trac.wordpress.org/browser/woocommerce-exporter/tags/2.8.0/includes/Abstracts/Abstract_Exporter.php#L1011 · [email protected]https://plugins.trac.wordpress.org/browser/woocommerce-exporter/tags/2.8.0/includes/Abstracts/Abstract_Exporter.php#L396 · [email protected]https://plugins.trac.wordpress.org/browser/woocommerce-exporter/tags/2.8.0/includes/Abstracts/Abstract_Exporter.php#L418 · [email protected]https://plugins.trac.wordpress.org/browser/woocommerce-exporter/tags/2.8.0/includes/Classes/WP_Admin.php#L325 · [email protected]https://plugins.trac.wordpress.org/changeset?reponame=&old=3689535%40woocommerce-exporter&new=3689535%40woocommerce-exporter · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/c664b2b3-7ecf-4bd7-8623-3e882acfd945?source=cve · [email protected]
EPSS history
Timeline
  • 19 SEP 03:50Z
    EPSS moved — → 1%
    epss
  • 18 SEP 07:40Z
    Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
    cvelistv5