CVE-2026-42661
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The WP Customer Area plugin versions up to 8.3.4 contain a Path Traversal vulnerability, which may allow unauthorized access to system files.
Risk Assessment
An attacker could exploit this vulnerability to gain access to sensitive data, posing a serious security threat to the organization.
Recommendation
It is recommended to update the WP Customer Area plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in WP Customer Area
See all- CVE-2026-116854Medium
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
- CVE-2026-7640Medium
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute.
- CVE-2025-60201High
The WordPress plugin WP Customer Area before version 8.3.4 contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename for include/require statement. This allows an attacker to include local PHP files.
Original NVD description (English source)
Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS