{
 "id": "WPSEC-2026-2033",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2033/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2033/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2033/index.md",
 "title": "SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 2.8.0 - Authenticated (Subscriber+) Arbitrary File Read via Opt-in File Download",
 "description": "The SellKit plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read via the opt-in file download handler (admin-post action 'sellkit_download_file') in versions 2.3.0 up to, and including, 2.8.0. This is due to the block editor opt-in handler accepting a base64-encoded absolute file path, protecting it only with a generic nonce (default action) that is not tied to the file, and checking the unresolved path string against the uploads directory prefix instead of the resolved real path. This makes it possible for authenticated attackers, with Subscriber-level access and above, who obtain that nonce (for example by submitting an opt-in form that offers a file download), to use '../' sequences to read files outside the uploads directory, as long as WordPress allows the file's extension. Such files may contain sensitive information. This affects sites that use the block editor (Gutenberg) mode of the plugin.",
 "plugin": {
  "slug": "sellkit",
  "name": "SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster",
  "full_name": "SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster",
  "wordpress_org": "https://wordpress.org/plugins/sellkit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sellkit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sellkit"
 },
 "type": "LFI",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.3.0",
    "from_inclusive": true,
    "to": "2.8.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.3.0 before 2.8.1"
  ]
 },
 "introduced_in": "2.3.0",
 "fixed_in": "2.8.1",
 "remediation": "Update to 2.8.1 or later.",
 "fix_released": "2026-10-29T09:59:42+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:46:52.724560+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2033/",
  "https://plugins.svn.wordpress.org/sellkit/tags/2.8.1/",
  "https://wordpress.org/plugins/sellkit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sellkit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}