CVE-2026-15323: Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumisesecurity nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote visitor can exploit it. No account, prior access, or credentials are required because the required lumise_security nonce can be obtained through the publicly accessible /?lumise=ajax action=init handler.
What access does exploitation provide?
An attacker can read arbitrary files from the server through directory traversal in the cart JSON upload handling. Exposed files may contain sensitive information; the provided data does not indicate that the issue enables file modification or code execution.
Which installations are affected?
All Lumise versions up to and including 2.1.2 are affected. The vulnerable functionality is reachable through the /?lumise=cart endpoint.
How can I determine whether my site is exposed?
A site is exposed if it runs Lumise version 2.1.2 or earlier and the Lumise cart endpoint is available. The required nonce being obtainable from the public init action means a normal unauthenticated visitor can reach the prerequisite functionality.