Executive brief
The Direct Download for WooCommerce plugin allows customers to download digital products in WooCommerce stores. An attacker can exploit a directory traversal vulnerability to read any file on the server without authentication, potentially exposing sensitive configuration files, database credentials, or private customer data. The flaw affects all versions up to 1.19 and requires only that the store has at least one free virtual product configured.
Technical details
The plugin contains a directory traversal vulnerability in its top-level include function that fails to properly validate file path requests. Although the code checks for the existence of a free, virtual, downloadable product on the site, it does not verify that the requested file path belongs to that product's configured downloads. An unauthenticated attacker can bypass this weak validation by crafting requests with relative paths (e.g., ../../../etc/passwd) to read arbitrary files from the server filesystem. No authentication or user interaction is required; exploitation is viable on any WooCommerce site with at least one free virtual product. A patch should be available from the plugin developers.
Affected products
- KOD Direct Download for WooCommerce up to and including 1.19
Timeline
- 2026-09-10: disclosed