Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-15019

Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-15019

Published

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site — not that the requested file path belongs to that product's configured downloads — making exploitation viable on any WooCommerce site with at least one such product.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-15019

Published

Direct Download for WooCommerce

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "kamalyon",
                    "product": "Direct Download for WooCommerce",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "1.19",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON