CVE-2026-7547 Details

A path traversal vulnerability allowing arbitrary file read has been identified in the Woosa – Marktplaats for WooCommerce plugin for WordPress, affecting versions through 2.0.4. The issue arises from inadequate path sanitization in the 'render_logs_ui' function, which processes a base64-encoded file name from the 'log_file' GET parameter. The function concatenates this file name with the plugin's log directory path without properly validating that the resulting path stays within the intended directory. This flaw enables authenticated attackers with Administrator-level access to read arbitrary files on the server, including sensitive files like 'wp-config.php'.

Users are advised to update the Woosa – Marktplaats for WooCommerce plugin to version 2.0.6 or later, where this vulnerability has been patched.