Security Alert Summary
The Bulk Order Update for WooCommerce plugin contains an Arbitrary File Read vulnerability that allows unauthenticated attackers to request an AJAX endpoint and retrieve the first parsed line of arbitrary files on the server. The issue is due to an AJAX handler being registered without capability or nonce checks and insufficient validation of a user-supplied CSV URL parameter.
CVE Details
- CVE ID: CVE-2026-14500
- Affected component: Bulk Order Update for WooCommerce plugin
- Affected versions: up to and including 1.6
- Published: July 8, 2026 at 06:16:22 AM UTC
- Last modified: July 8, 2026 at 04:16:27 PM UTC
- CVSS v3.1:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N— Base score 5.3 (MEDIUM) - Authentication: None required
- Privileges required: None
- User interaction: None
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- Weakness: CWE-22 (Path Traversal)
Technical Details
The plugin registers an AJAX handler named bouw_fetch_csv_data() on the wp_ajax_nopriv_ hook without performing capability checks or nonce validation. The handler accepts a POST parameter named csv_url that is filtered with esc_url_raw() and validate_file() before being passed directly to fopen() and fgetcsv(). esc_url_raw() allows absolute filesystem paths, and validate_file() only rejects certain traversal patterns, leaving other absolute paths intact.
Because the handler reflects the first parsed CSV line in its JSON response, an unauthenticated attacker can provide a path to a local file and retrieve the first line of that file (for example, /etc/passwd). The handler can also be used as a file-existence oracle.
How This Could Impact Your Website
In a realistic scenario, an unauthenticated attacker could probe the exposed AJAX endpoint to read a single line from files accessible to the web server. For a site owner and internal staff, this could reveal small pieces of sensitive information stored in readable files. For example, if a configuration export, log, or other file containing user email addresses or environment details is readable and its first line contains identifying data, that information could be exposed.
An external contractor or contributor with limited privileges could be targeted by attackers who use discovered file information to craft more convincing phishing or social engineering attempts. The direct impact indicated by the CVSS is limited to confidentiality and is restricted to the data that can be read via the handler; there is no indication of integrity or availability impact from this vulnerability.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior or unexpected requests to AJAX endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/bulk-order-update-for-woocommerce/tags/1.6/inc/plugin-html.php#L23
- https://plugins.trac.wordpress.org/browser/bulk-order-update-for-woocommerce/tags/1.6/inc/plugin-html.php#L33
- https://plugins.trac.wordpress.org/browser/bulk-order-update-for-woocommerce/tags/1.6/inc/plugin-html.php#L48
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d3aa1f74-6372-4abe-894b-07ad3e81ea81?source=cve
