Executive brief
The AR for WooCommerce plugin for WordPress, which adds augmented reality features to online stores, contains a security flaw that allows anyone to read files from the website's server. An attacker could use this to steal sensitive configuration files or customer data without needing a password. This vulnerability affects all versions of the plugin up to 8.40 and has been addressed in version 8.41.
Technical details
A directory traversal vulnerability exists in the 'file' parameter of the AR for WooCommerce plugin due to insufficient input validation and failing access controls. Specifically, unauthenticated attackers can obtain valid nonces via the 'ar_get_fresh_nonce' and 'ar_process_user_image' AJAX handlers. Furthermore, the AES-256-CBC encryption used for path payloads relies on a predictable key derived from a missing license key option in default installations. By bypassing a trivially spoofed Referer check, an attacker can read sensitive files (such as wp-config.php) from the server. The issue is fixed in version 8.41.
Affected products
- webandprint AR for WooCommerce up to, and including, 8.40
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory
References
- https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/ar-woocommerce.php
- https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/ar-woocommerce.php
- https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/includes/ar-secure-download.php
- https://plugins.trac.wordpress.org/browser/ar-for-woocommerce/tags/8.40/includes/ar-secure-download.php
- https://plugins.trac.wordpress.org/changeset/3593279/ar-for-woocommerce/trunk/includes/ar-secure-download.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Far-for-woocommerce/tags/8.40&new_path=%2Far-for-woocommerce/tags/8.41
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2049712a-6ff2-4e2a-98f8-93a493a5bfd3?source=cve