CVE-2026-14500: Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata() AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied csvurl POST parameter — filtered only by escurlraw() (which leaves absolute filesystem paths intact) and validatefile() (which only rejects '..' traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bulk Order Update for WooCommerceto a version that resolves this vulnerability.Fixed in 1.6 - Configuration
Modify the bouw_fetch_csv_data() AJAX handler to require an authenticated user capability and a nonce check (do not leave it registered on wp_ajax_nopriv without authorization).
Bulk Order Update for WooCommerce (bouw_fetch_csv_data AJAX handler) wp_ajax_nopriv hook registration / capability & nonce checks = Add capability check and nonce verification before processing csv_url - Configuration
Harden csv_url handling so it cannot reference absolute filesystem paths (esc_url_raw() keeps them) and cannot be used to open arbitrary server files; ensure validation prevents using csv_url to read files outside intended directories (validate_file() currently only rejects '..' traversal).
Bulk Order Update for WooCommerce (bouw_fetch_csv_data AJAX handler) csv_url validation before fopen()/fgetcsv() = Reject absolute filesystem paths; restrict to allowed locations/sources
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14500?
The severity of CVE-2026-14500 is medium, with a score of 5.3.
How do I fix CVE-2026-14500?
To fix CVE-2026-14500, update the Bulk Order Update for WooCommerce plugin to a version later than 1.6.
What type of vulnerability is CVE-2026-14500?
CVE-2026-14500 is classified as an Unauthenticated Arbitrary File Read vulnerability.
What can be exploited in CVE-2026-14500?
CVE-2026-14500 can be exploited via the 'csv_url' parameter to read arbitrary files on the server.
Which versions of WooCommerce are affected by CVE-2026-14500?
CVE-2026-14500 affects versions of WooCommerce Bulk Order Update up to and including 1.6.