Product Designer for WooCommerce WordPress (<= 2.1.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/product-designer-for-woocommerce-wordpress--2.1.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 08:26:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProduct Designer for WooCommerce: Arbitrary file read via directory traversal (CVE-2026-15323)https://feed.craftedsignal.io/briefs/2026-10-lumise-directory-traversal/Wed, 28 Oct 2026 08:26:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-lumise-directory-traversal/The Product Designer for WooCommerce plugin (<= 2.1.2) contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary server files by leveraging a predictable security nonce.The Product Designer for WooCommerce WordPress plugin is vulnerable to directory traversal through the process_checkout function in versions 2.1.2 and earlier. An attacker can obtain a lumise_security nonce by calling the /?lumise=ajax action=init endpoint, which is accessible to unauthenticated users. This nonce can then be used to target the /?lumise=cart endpoint to read arbitrary files from the server filesystem. This flaw allows for the unauthorized disclosure of sensitive configuration data.

Attack Chain

  1. Attacker navigates to the public /?lumise=ajax action=init endpoint.
  2. Attacker retrieves the lumise_security nonce from the application response.
  3. Attacker crafts a request to the /?lumise=cart endpoint.
  4. Attacker includes the harvested nonce and directory traversal sequences (e.g., ../) in the parameters.
  5. The process_checkout function fails to sanitize path inputs, allowing access to files outside the intended directory.
  6. The server returns the contents of the requested file in the HTTP response.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files from the WordPress server, potentially leading to the exposure of credentials, database configuration files (wp-config.php), or other sensitive system information.

Recommendation

  1. Upgrade the Product Designer for WooCommerce (Lumise) plugin to version 2.1.3 or later as soon as it becomes available.
  2. Until a patch is applied, consider disabling the plugin or restricting access to the /?lumise= endpoints via a Web Application Firewall (WAF).
  3. Monitor web server access logs for anomalous requests to /?lumise=cart containing path traversal characters like "../".
]]>highadvisorywordpressplugindirectory-traversalcve-2026-15323