CVE-2026-15019 is a directory traversal vulnerability (CWE-22) in the Direct Download for WooCommerce plugin for WordPress, affecting all versions up to and including 1.19. The vulnerability allows unauthenticated remote attackers to read arbitrary files on the server by manipulating the file path parameter in the top-level include function. The plugin's product ownership verification is insufficient, as it only checks for the presence of a free virtual downloadable product rather than confirming the requested file path is legitimately associated with that product. This enables exploitation on any WooCommerce site with at least one such product.

An unauthenticated attacker can read arbitrary files on the server hosting the vulnerable WooCommerce plugin. This can lead to disclosure of sensitive information stored in files accessible to the web server user. The vulnerability does not allow modification or deletion of files, nor does it affect availability. The CVSS 3.1 base score is 7.5 (High), reflecting the network attack vector, no privileges required, no user interaction, and high confidentiality impact.

No official patch or remediation is currently confirmed. Users should monitor the vendor's advisory for updates. Until a fix is available, consider restricting access to the plugin or disabling it if possible. Review server file permissions to limit exposure of sensitive files. Avoid hosting free virtual downloadable products if not necessary, as the vulnerability requires at least one such product to be exploitable.