CVE-2026-7547 is a path traversal vulnerability (CWE-22) in the Woosa – Marktplaats for WooCommerce WordPress plugin up to version 2.0.4. The issue arises because the render_logs_ui() function accepts a base64-encoded filename via the 'log_file' GET parameter and concatenates it directly with the plugin's log directory path without validating that the resulting path remains within the intended directory. This allows authenticated users with Administrator privileges to read arbitrary files on the server, potentially exposing sensitive configuration data such as wp-config.php. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity), with network attack vector, low attack complexity, and requiring high privileges but no user interaction.

An authenticated attacker with Administrator-level access can exploit this vulnerability to read arbitrary files on the server hosting the WordPress site. This can lead to disclosure of sensitive information, including configuration files like wp-config.php, which may contain database credentials and other secrets. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and monitor for suspicious activity related to the 'log_file' parameter. Avoid exposing the plugin's log directory or sensitive files to unauthorized access.