Medium severity6.5NVD Advisory· Published Jul 25, 2026· Updated Jul 27, 2026
CVE-2026-14955
CVE-2026-14955
Description
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=3.7.7
- Range: <=3.7.7
Patches
Vulnerability mechanics
References
2News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)Wordfence Blog · Jul 30, 2026