TI-2026-12248 CVE-2026-14500 · GHSA-74pw-3rq8-72px
Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
Priority LOW 30
The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6.