CVE-2026-15019

CVE-2026-15019 is an unauthenticated directory traversal vulnerability (CWE-22) in the Direct Download for WooCommerce WordPress plugin, affecting all versions up to and including 1.19, in the plugin's file-serving (include) logic. A remote, unauthenticated attacker can send a crafted request to the plugin's download endpoint with a path value that escapes the intended download directory; the plugin's ownership check only verifies that some free, virtual, downloadable product exists on the site, not that the requested path belongs to that product's configured downloads. This allows the attacker to read the contents of arbitrary files on the server, such as wp-config.php containing database credentials and authentication keys, with no modification of files or system state. Any WordPress/WooCommerce site running the plugin at version 1.19 or earlier and having at least one free, virtual, downloadable product is exploitable. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known as of this writing; severity is rated high (CVSS 3.1 7.5, confidentiality impact only).

What to do: Update Direct Download for WooCommerce to the first release after 1.19 as soon as one is published (the source data confirms 1.19 is affected but does not name the patched version). Until an update is available, deactivate the plugin or apply a WAF/virtual-patch rule blocking directory-traversal sequences in its download request parameters. Site owners should check whether their catalog contains any free, virtual, downloadable product (which makes the site exploitable) and review access logs for unexpected requests to the plugin's download endpoint.