CVE-2026-15019

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

PT-2026-89262

Name of the Vulnerable Software and Affected Versions Direct Download for WooCommerce versions prior to 1.20 Description A Directory Traversal issue exists in the top-level include function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitiv...