Executive brief
The Store Exporter plugin for WordPress allows shop managers and administrators to export WooCommerce data such as products, orders, and customers. The plugin contains a directory traversal vulnerability in its filename handling that could allow authenticated users with manager-level privileges to read sensitive files from the server, including configuration data and private keys.
Technical details
The vulnerability is a directory traversal (path traversal) flaw in the 'filename' parameter of The Store Exporter plugin, affecting versions up to and including 2.8.0. The vulnerable code fails to properly sanitize user-supplied input in the filename parameter, allowing authenticated attackers with shop manager access or higher privileges to craft requests that traverse the server filesystem using path traversal sequences (e.g., ../). Exploitation requires valid WordPress authentication with at least shop manager role. An attacker can read arbitrary files on the server that are accessible to the web server process, potentially exposing configuration files, database credentials, private keys, and other sensitive data. Patches should be available in plugin versions after 2.8.0.
Affected products
- ACME The Store Exporter up to and including 2.8.0
Timeline
- 2026-09-18: disclosed