EUVD-2026-48764

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...

CVE-2026-14955

The CVE-2026-14955 entry affects the Checkout Field Editor for WooCommerce (Pro) for WordPress, specifically versions up to 3.7.7. The root cause is a Directory Traversal vulnerability in the thwcfe_legacy_file parameter, allowing authenticated users with subscriber-level access and above to read...

PT-2026-64473

Name of the Vulnerable Software and Affected Versions Checkout Field Editor for WooCommerce Pro versions prior to 3.7.8 Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder. Authenticat...