WordPress AR Plugin <=8.40 Unauthenticated Arbitrary File Read via Directory Traversal (CVE-2026-14327)

Vulnerability Overview Vulnerability Name: AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter CVSS Score: 7.5 CVE ID: CVE-2026-14327 Release Date: July 2, 2026 Last Updated: July 3, 2026 Researcher: CHOIGYEONGMIN Impact Scope Affected Versions: AR for WordPress <= 8.40 Vulnerability Type: Directory Traversal Description: The AR for WordPress plugin, up to and including version 8.40, contains a directory traversal vulnerability. Attackers can read arbitrary files from the server, including sensitive information, via the parameter. Exploiting this vulnerability requires the attacker to first obtain valid and values, which can be achieved using publicly available AJAX handlers. Remediation Fixed Version: Upgrade to version 8.41 or higher Patch Status: Fixed Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Vulnerabilities AR for WordPress <= 8.31 - Cross-Site Request Forgery - CVE ID: CVE-2025-60156 - CVSS Score: 4.3 - Researcher: Abu Hurayra (HusaylIT) - Release Date: September 26, 2025 AR for WordPress <= 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-26913 - CVSS Score: 6.4 - Researcher: Truong Hưu Phúc (truonghuuphuc) - Release Date: February 23, 2025 AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload - CVE ID: CVE-2024-12300 - CVSS Score: 3.7 - Researcher: cc - Release Date: December 12, 2024 AR for WordPress <= 6.6 - Unauthenticated Arbitrary File Upload - CVE ID: CVE-2024-50496 - CVSS Score: 9.8 - Researcher: João Pedro Soares de Alcântara - Release Date: October 25, 2024 Summary The AR for WordPress plugin, up to and including version 8.40, contains a directory traversal vulnerability that allows attackers to read arbitrary files from the server via the parameter. It is recommended to upgrade to version 8.41 or higher to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress AR Plugin <=8.40 Unauthenticated Arbitrary File Read via Directory Traversal (CVE-2026-14327)

More from this source