Product Designer for WooCommerce: Arbitrary file read via directory traversal (CVE-2026-15323)

The Product Designer for WooCommerce WordPress plugin is vulnerable to directory traversal through the process_checkout function in versions 2.1.2 and earlier. An attacker can obtain a lumise_security nonce by calling the /?lumise=ajax action=init endpoint, which is accessible to unauthenticated users. This nonce can then be used to target the /?lumise=cart endpoint to read arbitrary files from the server filesystem. This flaw allows for the unauthorized disclosure of sensitive configuration data.

Attack Chain

1. Attacker navigates to the public /?lumise=ajax action=init endpoint.
2. Attacker retrieves the lumise_security nonce from the application response.
3. Attacker crafts a request to the /?lumise=cart endpoint.
4. Attacker includes the harvested nonce and directory traversal sequences (e.g., ../) in the parameters.
5. The process_checkout function fails to sanitize path inputs, allowing access to files outside the intended directory.
6. The server returns the contents of the requested file in the HTTP response.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files from the WordPress server, potentially leading to the exposure of credentials, database configuration files (wp-config.php), or other sensitive system information.

Recommendation

1. Upgrade the Product Designer for WooCommerce (Lumise) plugin to version 2.1.3 or later as soon as it becomes available.
2. Until a patch is applied, consider disabling the plugin or restricting access to the /?lumise= endpoints via a Web Application Firewall (WAF).
3. Monitor web server access logs for anomalous requests to /?lumise=cart containing path traversal characters like "../".