SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 2.8.0 - Authenticated (Subscriber+) Arbitrary File Read via Opt-in File Download
- ID
- WPSEC-2026-2033
- Plugin
- SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster (sellkit)
- Affected
- from 2.3.0 before 2.8.1
- Remediation
- Update to 2.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster on WPSec AttackSurface
- Fix released
- Published
Description
The SellKit plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read via the opt-in file download handler (admin-post action 'sellkit_download_file') in versions 2.3.0 up to, and including, 2.8.0. This is due to the block editor opt-in handler accepting a base64-encoded absolute file path, protecting it only with a generic nonce (default action) that is not tied to the file, and checking the unresolved path string against the uploads directory prefix instead of the resolved real path. This makes it possible for authenticated attackers, with Subscriber-level access and above, who obtain that nonce (for example by submitting an opt-in form that offers a file download), to use '../' sequences to read files outside the uploads directory, as long as WordPress allows the file's extension. Such files may contain sensitive information. This affects sites that use the block editor (Gutenberg) mode of the plugin.
References
- https://wpsec.com/vuln/WPSEC-2026-2033/
- https://plugins.svn.wordpress.org/sellkit/tags/2.8.1/
- https://wordpress.org/plugins/sellkit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS