CVE-2026-42661 is a path traversal vulnerability in the WP Customer Area plugin by aguilatechnologies affecting versions up to 8.3.4. The issue arises from improper handling of custom role paths, allowing an attacker with limited privileges to traverse directories using sequences like '.../...//'. This can lead to unauthorized access or modification of files outside the intended directory scope. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to access or modify files outside the intended directory structure, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for unusual file access patterns related to WP Customer Area. Avoid exposing the affected plugin to untrusted users where possible.