CVE-2026-14352 is a directory traversal vulnerability (CWE-22) in the AR for WooCommerce plugin for WordPress affecting all versions up to and including 8.40. The flaw is exploitable via the 'file' parameter, allowing unauthenticated attackers to read arbitrary server files. The plugin's three intended access controls fail: nonces can be freely generated by unauthenticated users through AJAX handlers; the AES-256-CBC encryption key is derived from a license key option that defaults to false on free installations, resulting in a predictable key; and the referer header check is trivially bypassed as the header is attacker-controlled. This combination enables unauthorized file disclosure without user interaction or privileges.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the plugin, potentially exposing sensitive information such as configuration files, credentials, or other private data. The vulnerability does not affect integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin functionality to prevent exploitation. Monitor the vendor's communications for updates and apply patches promptly once released.