CVE-2026-16777 jkohlbach CVE debrief

Who should care

WordPress site administrators, security teams, and users with shop manager-level access and above should assess exposure and apply patches to prevent potential sensitive information disclosure.

Why it matters

CVE-2026-16777 is a Medium-severity vulnerability in the Store Exporter plugin for WordPress. Authenticated attackers with shop manager-level access can exploit the Directory Traversal vulnerability to access sensitive files. WordPress administrators and security teams should assess exposure, apply patches, and monitor server logs to prevent potential sensitive information disclosure.

• Potential unauthorized access to sensitive files on the server.
• Possible exposure of sensitive information, such as database credentials or encryption keys.
• Increased risk of lateral movement within the network if exploited in conjunction with other vulnerabilities.
• Verification of patch application and monitoring of server logs for suspicious activity are necessary.

Technical summary

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0. The vulnerability is caused by insufficient sanitization of the 'filename' parameter, allowing authenticated attackers with shop manager-level access and above to read the contents of arbitrary files on the server.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Store Exporter plugin is installed and if the version is 2.8.0 or earlier.
• Verify that shop manager-level access and above roles are properly secured.
• Apply patches or updates provided by the vendor to fix the Directory Traversal vulnerability.
• Monitor server logs for suspicious file access attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in plugin versions up to 2.8.0. Authenticated attackers with shop manager-level access can exploit the Directory Traversal vulnerability via the 'filename' parameter. Evidence from security researchers indicates that the vulnerability allows reading of arbitrary files on the server, which may contain sensitive information. The lack of proper sanitization of the 'filename' parameter enables this vulnerability. Limited details are available on publicly known exploits or affected systems. Security teams are

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.