# SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 2.8.0 - Authenticated (Subscriber+) Arbitrary File Read via Opt-in File Download

- **ID:** WPSEC-2026-2033
- **Plugin:** SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster (`sellkit`), https://wordpress.org/plugins/sellkit/
- **Affected versions:** from 2.3.0 before 2.8.1
- **Fixed in:** 2.8.1 (Update to 2.8.1 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sellkit
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2033/

## Description

The SellKit plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read via the opt-in file download handler (admin-post action 'sellkit_download_file') in versions 2.3.0 up to, and including, 2.8.0. This is due to the block editor opt-in handler accepting a base64-encoded absolute file path, protecting it only with a generic nonce (default action) that is not tied to the file, and checking the unresolved path string against the uploads directory prefix instead of the resolved real path. This makes it possible for authenticated attackers, with Subscriber-level access and above, who obtain that nonce (for example by submitting an opt-in form that offers a file download), to use '../' sequences to read files outside the uploads directory, as long as WordPress allows the file's extension. Such files may contain sensitive information. This affects sites that use the block editor (Gutenberg) mode of the plugin.

## References

- https://wpsec.com/vuln/WPSEC-2026-2033/
- https://plugins.svn.wordpress.org/sellkit/tags/2.8.1/
- https://wordpress.org/plugins/sellkit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2033/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.