CVE-2026-15019: Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site — not that the requested file path belongs to that product's configured downloads — making exploitation viable on any WooCommerce site with at least one such product.
Affected Software
Event History
Frequently Asked Questions
Which sites are realistically exposed to exploitation?
Any site running Direct Download for WooCommerce version 1.19 or earlier is exposed if it has at least one WooCommerce product that is free, virtual, and downloadable. The requested file does not need to be one of that product's configured downloads.
Does exploitation require an authenticated WordPress or WooCommerce account?
No. The vulnerability can be exploited by an unauthenticated attacker over the network, with no user interaction required.
What could an attacker obtain through this issue?
An attacker can read arbitrary files on the server through directory traversal. Files accessible to the affected application may contain sensitive information.
How can I determine whether the site meets the stated exploitation condition?
Check whether the affected plugin is installed at version 1.19 or earlier, then review WooCommerce products for at least one product configured as free, virtual, and downloadable. If both conditions are present, the described product ownership check can be satisfied.