CVE-2026-42661 is a path traversal vulnerability in the WP Customer Area plugin by aguilatechnologies affecting versions up to 8.3.4. The issue involves improper handling of file paths in custom roles, allowing an attacker with certain privileges to traverse directories and access files outside the intended scope. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with custom role privileges to read or modify files outside the permitted directories, potentially leading to disclosure of sensitive information, unauthorized data modification, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict custom role permissions to trusted users only and monitor for suspicious activity related to file access.