Is CVE-2026-14955 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-14955?

CVE-2026-14955 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-14955

Description

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.