CVE-2026-32477: WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

Q: Does an attacker need an account or user interaction to exploit this issue?

No. The vulnerability is unauthenticated and can be exploited remotely without privileges or user interaction.

Q: What is the potential impact?

An attacker may be able to delete arbitrary files through path traversal. The available severity vector indicates high availability impact, while confidentiality and integrity impacts are listed as none.

Q: Which installations are known to be affected?

ShopBuilder Pro – Elementor WooCommerce Builder Addons versions 2.2.0 and earlier are identified as affected.

Published Aug 24, 2026

Updated

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.

Affected Software

1 affected component

WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons<=2.2.0

Event History

Aug 24, 2026

CVE Published

via MITRE·11:54 AM

Data Sourced

via MITRE·11:54 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need an account or user interaction to exploit this issue?

No. The vulnerability is unauthenticated and can be exploited remotely without privileges or user interaction.

What is the potential impact?

An attacker may be able to delete arbitrary files through path traversal. The available severity vector indicates high availability impact, while confidentiality and integrity impacts are listed as none.

Which installations are known to be affected?