CVE-2026-14352 is a directory traversal vulnerability (CWE-22) in the AR for WooCommerce plugin for WordPress, affecting all versions up to and including 8.40. The vulnerability arises from improper limitation of pathname inputs via the 'file' parameter, enabling unauthenticated attackers to read arbitrary server files. The plugin's three intended access controls are ineffective: nonces can be generated by unauthenticated users through AJAX handlers; the encryption key used for path payloads is predictable on default free installations; and the referer header check can be trivially bypassed as it is attacker-controlled. This results in a high-severity vulnerability with a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information such as configuration files, credentials, or other private data stored on the server. The confidentiality impact is high, while integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the AR for WooCommerce plugin or restricting access to the affected functionality. Monitor official vendor channels for updates and apply any official patches or updates once released.