WordPress · CVE research

CVE-2026-3464: WP Customer Area arbitrary file read

A proof-of-concept write-up for CVE-2026-3464 affecting WP Customer Area. I did not discover the original vulnerability; this page documents the publicly known issue and an independent PoC I wrote to reproduce the file-read behavior in an authorized lab.

Use only on systems you own or are explicitly authorized to test. This page explains the vulnerability and PoC design without publishing deployable exploit code.

Public vulnerability summary

CVE: CVE-2026-3464
Product: WP Customer Area
Affected versions: Up to and including 8.3.4
Class: Path traversal leading to authenticated arbitrary file read / deletion
Weakness: CWE-22

How it works

The vulnerable plugin flow handles files attached to Customer Area private-file posts. In affected versions, user-controlled path information is not constrained tightly enough to the intended directory. That allows a crafted path to resolve outside the expected storage location.

For the read case, the affected attachment workflow can cause a server-side file to be treated as a normal private-file attachment. Once that happens, the file becomes retrievable through the plugin's ordinary authenticated download mechanism. Public advisories also describe a related arbitrary-file-deletion impact stemming from the same path-validation weakness.

My PoC

My Python PoC is deliberately single-target and requires an explicit authorization flag. It authenticates to WordPress, finds or uses a private-file post, obtains the nonce required by the attachment flow, submits a traversal-style filename through the affected handler, and then retrieves the resulting attachment through the normal download path.

The script includes a few guardrails: it stays on the chosen origin, rejects cross-origin redirects, does not embed credentials in the target URL, and does not implement the deletion primitive. The PoC is focused only on demonstrating the file-read behavior.

Why it matters

Arbitrary file read can expose sensitive files that are readable by the web application process, including configuration material, secrets, or application data. The related deletion primitive increases the integrity and availability impact.

Remediation

Administrators should update WP Customer Area to a version containing the vendor's fix and review any exposed file-handling paths. Path resolution should be constrained to intended directories before file operations are performed.

About the PoC source

The PoC I wrote targets WP Customer Area 8.3.4 and implements only the arbitrary-file-read path. The source includes an authorization check and does not include the related deletion primitive. The source can be found here

Back to PoCs