CVE-2026-16777 in Store Exporter Plugin
Summary
by MITRE • 09/18/2026
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Store Exporter plugin for WordPress represents a critical security flaw classified as Directory Traversal, formally known under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This issue affects all versions up through 2.8.0 and is triggered specifically via the filename parameter during export operations. The core technical failure lies in the insufficient sanitization or validation of user-supplied input within this parameter, allowing an attacker to manipulate file path references beyond their intended scope. By injecting directory traversal sequences such as dot-dot-slash into the filename argument, the application fails to restrict access strictly to the designated WooCommerce data directories, thereby exposing the underlying server filesystem structure to unauthorized inspection and retrieval.
From a technical perspective, this flaw enables authenticated attackers who possess shop manager-level privileges or higher to read arbitrary files residing on the web server. The operational impact of such an exploit is severe, as it facilitates the exfiltration of sensitive information that may include database configuration credentials, private keys, source code containing hardcoded secrets, or other proprietary data stored outside the public web root but accessible via relative path manipulation. This capability effectively bypasses standard access controls intended to isolate application-specific files from system-level configurations and critical infrastructure components, leading to a complete compromise of confidentiality for any file reachable through the constructed traversal paths.
In terms of threat modeling and industry frameworks, this vulnerability aligns with ATT&CK technique T1083: File and Directory Discovery, where adversaries use operating-system specific commands or techniques to enumerate files and directories on compromised systems. The exploitation chain typically involves authenticating into the WordPress dashboard using elevated credentials, navigating to the export functionality of the Store Exporter plugin, and submitting a crafted request with malicious path sequences in the filename field. This action causes the server-side script to resolve the relative paths incorrectly, resulting in the outputting or downloading of files that were not intended for user access. The severity is amplified by the fact that it requires authentication, which may seem like a mitigating factor but remains significant given that shop manager accounts are often targeted through credential stuffing or phishing attacks due to their high level of trust and access within the WordPress ecosystem.
Mitigation strategies must prioritize immediate remediation alongside defensive hardening measures. The most effective solution is to upgrade the Store Exporter plugin to version 2.8.1 or later, where developers have implemented proper input validation and path canonicalization checks to ensure that only files within allowed directories can be accessed. For organizations unable to patch immediately due to compatibility constraints, temporary mitigations include restricting file upload and export permissions to a minimal set of trusted administrators rather than all shop managers. Additionally, implementing Web Application Firewall rules that detect common directory traversal patterns in POST parameters related to file operations can provide an additional layer of defense. Regular auditing of plugin code for similar input handling flaws is also recommended to prevent recurrence of this class of vulnerability across the WordPress application stack.