CVE-2026-14500: Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter

Published Jul 8, 2026
·
Updated

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata() AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied csvurl POST parameter — filtered only by escurlraw() (which leaves absolute filesystem paths intact) and validatefile() (which only rejects '..' traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.

Affected Software

1 affected component
WooCommerce WooCommerce Bulk Order Update<=1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Bulk Order Update for WooCommerce to a version that resolves this vulnerability.

    Fixed in 1.6
  2. Configuration

    Modify the bouw_fetch_csv_data() AJAX handler to require an authenticated user capability and a nonce check (do not leave it registered on wp_ajax_nopriv without authorization).

    Bulk Order Update for WooCommerce (bouw_fetch_csv_data AJAX handler) wp_ajax_nopriv hook registration / capability & nonce checks = Add capability check and nonce verification before processing csv_url
  3. Configuration

    Harden csv_url handling so it cannot reference absolute filesystem paths (esc_url_raw() keeps them) and cannot be used to open arbitrary server files; ensure validation prevents using csv_url to read files outside intended directories (validate_file() currently only rejects '..' traversal).

    Bulk Order Update for WooCommerce (bouw_fetch_csv_data AJAX handler) csv_url validation before fopen()/fgetcsv() = Reject absolute filesystem paths; restrict to allowed locations/sources

Event History

Jul 8, 2026
CVE Published
via MITRE·05:34 AM
Data Sourced
via MITRE·05:34 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-14500?

The severity of CVE-2026-14500 is medium, with a score of 5.3.

2

How do I fix CVE-2026-14500?

To fix CVE-2026-14500, update the Bulk Order Update for WooCommerce plugin to a version later than 1.6.

3

What type of vulnerability is CVE-2026-14500?

CVE-2026-14500 is classified as an Unauthenticated Arbitrary File Read vulnerability.

4

What can be exploited in CVE-2026-14500?

CVE-2026-14500 can be exploited via the 'csv_url' parameter to read arbitrary files on the server.

5

Which versions of WooCommerce are affected by CVE-2026-14500?

CVE-2026-14500 affects versions of WooCommerce Bulk Order Update up to and including 1.6.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203