CVE-2026-14500
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Bulk Order Update for WooCommerce plugin for WordPress up to version 1.6 is vulnerable to arbitrary file read. Unauthenticated attackers can read the first line of any file on the server, such as /etc/passwd, via the bouw_fetch_csv_data() AJAX handler.
Risk Assessment
The risk involves an unauthenticated attacker reading sensitive system files, potentially leading to attack escalation or disclosure of server configuration information.
Recommendation
Immediately update the Bulk Order Update for WooCommerce plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.
Original NVD description (English source)
The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook with no capability or nonce check, and passing the attacker-supplied csv_url POST parameter — filtered only by esc_url_raw() (which leaves absolute filesystem paths intact) and validate_file() (which only rejects '..' traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.