CVE-2026-42661: WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability

Synopsis

A path traversal vulnerability affects the WP Customer Area WordPress plugin in versions 8.3.4 and earlier. The flaw is reachable over the network by any authenticated user holding a custom role, with no additional user interaction required, and it arises because the plugin fails to sanitize file path input before using it in filesystem operations. Successful exploitation gives an attacker read access to arbitrary files on the server, the ability to write or overwrite files, and can fully compromise the host. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationRequired

  A low-privilege account is sufficient; any user assigned a custom role in the WordPress installation can trigger the traversal.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user; the exploit is executed entirely by the attacker directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific conditions to succeed.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress configuration files that store database credentials and secret keys.
• Writes or overwrites arbitrary files on the server, enabling the attacker to plant a web shell or corrupt application files.
• Gains full control over the WordPress application and potentially the underlying host, depending on filesystem permissions.