CVE-2026-49061: WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability

Synopsis

An unauthenticated arbitrary file download vulnerability affects the WPC Product Options for WooCommerce WordPress plugin in versions 3.2.1 and earlier. The flaw is reachable over the network with no login or account required, making it trivially accessible to any external attacker. Successful exploitation allows an attacker to download arbitrary files from the server, exposing potentially sensitive data such as configuration files, credentials, and private application data. HarborGuard is tracking the Patchstack advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress/WooCommerce service via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token of any privilege level is needed; the file download endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker sends a direct request to the vulnerable endpoint with no need for any user on the target site to take any action.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race condition, memory layout knowledge, or special environmental state is required.

Blast Radius

• Reads arbitrary files from the server filesystem, including wp-config.php, which contains database credentials and secret keys.
• Exposes private application data such as uploaded customer files, internal documents, or backup archives stored within the web root or accessible paths.
• Allows credential harvesting that can be used to pivot into the database or other connected services.
• Discloses environment and configuration details that assist further attack planning.