CVE-2026-14500 describes a path traversal vulnerability (CWE-22) in the Bulk Order Update for WooCommerce plugin for WordPress, affecting versions up to 1.6. The vulnerability arises from the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook without capability or nonce checks, enabling unauthenticated access. The csv_url POST parameter is filtered only by esc_url_raw() and validate_file(), which do not sufficiently prevent absolute filesystem paths or all traversal patterns. This parameter is then used directly in fopen() and fgetcsv(), allowing attackers to read the first line of arbitrary files on the server, such as /etc/passwd, and to use the handler as a file-existence oracle. No official patch or remediation level has been published as of the data provided.

An unauthenticated attacker can read the first line of arbitrary files on the server hosting the vulnerable plugin. This can lead to information disclosure of sensitive system files, potentially aiding further attacks. The vulnerability does not allow modification or denial of service but leaks file content and existence information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the AJAX handler if possible, or disable the plugin if not required. Monitor for updates from the vendor or plugin author for an official fix.