Directory Traversal in Direct Download for WooCommerce Plugin

The Direct Download for WooCommerce plugin for WordPress is affected by a directory traversal vulnerability (CVE-2026-15019) in versions up to and including 1.19. The issue arises from insufficient validation within the plugin's file download mechanism. Specifically, the top-level include function fails to ensure that requested file paths are restricted to the directory of products configured for download. Instead, the plugin only verifies the existence of a free, virtual, downloadable product on the site. An unauthenticated attacker can manipulate the file path parameter to traverse the directory structure and access sensitive system files outside the intended web root. This flaw poses a significant risk to confidentiality, potentially exposing WordPress configuration files (such as wp-config.php), environment variables, or other sensitive server data.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the WordPress server. This can lead to the exposure of database credentials, API keys, and other sensitive system information, facilitating further compromise of the WordPress environment or the underlying server infrastructure. All WordPress sites utilizing this plugin with at least one free, virtual, downloadable product configured are at risk.

Recommendation

• Update the "Direct Download for WooCommerce" plugin to a patched version beyond 1.19 immediately.
• If a patch is not available, disable the plugin until a secure update is provided.
• Inspect server access logs for anomalous requests to the plugin's file download endpoints containing traversal sequences like '../'.