CVE-2026-14500 is a path traversal vulnerability (CWE-22) in the Bulk Order Update for WooCommerce plugin for WordPress. The vulnerability arises from the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook without capability or nonce verification, allowing unauthenticated access. The handler accepts a csv_url POST parameter that is filtered only by esc_url_raw() and validate_file(), which do not sufficiently prevent absolute filesystem paths or all traversal patterns. This input is passed directly to fopen() and fgetcsv(), enabling attackers to read the first line of arbitrary files on the server and use the handler as a file-existence oracle. No official patch or remediation is currently documented.

An unauthenticated attacker can read the first line of arbitrary files on the server hosting the vulnerable plugin. This can lead to information disclosure of sensitive files such as /etc/passwd. The vulnerability does not allow file modification or denial of service. The CVSS 3.1 base score is 5.3 (medium), reflecting low complexity and no privileges required for exploitation, but limited impact to confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the AJAX handler if possible, or disable the Bulk Order Update plugin if not required. Monitor for updates from the plugin author or WordPress security advisories for an official fix.