WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for authenticated attackers with a role that an administrator grants access to (e.g., Subscriber) to to read the contents of arbitrary files on the server, which can contain sensitive information, or delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aguilatechnologies | WP Customer Area | up to 8.3.4 | — | No fix listed | CNA |
- WP Customer Area Vendoraguilatechnologies Affected up to 8.3.4 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3464
- 2026-10-03 Alias added: GHSA-9859-fqhx-279v
References
Other 11
- https://www.wordfence.com/threat-intel/vulnerabilities/id/aadf1f4c-c852-4167-9b09-7e679a953725?source=cve
- https://plugins.trac.wordpress.org/changeset/3507868/customer-area
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-addon.class.php#L844
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-addon.class.php#L883
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-addon.class.php#L920
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-default-handlers.class.php#L404
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-default-handlers.class.php#L422
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/private-file-default-handlers.class.php#L428
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/js/common/files/file-attachment-manager.js#L170
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/js/common/files/ftp-uploader.js#L63
- https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.4/src/php/core-addons/private-file/templates/private-attachments-add-ftp-folder-frontend.template.php#L17
More aguilatechnologies vulnerabilities
- TI-2026-30920 WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability CVSS 3.1HIGH 8.8
- TI-2025-37567 WordPress WP Customer Area plugin <= 8.3.5 - Local File Inclusion vulnerability CVSS 3.1HIGH 7.5
- TI-2026-84982 Reflected XSS in WordPress WP Customer Area plugin CVSS 3.1HIGH 7.1
- TI-2026-84979 Reflected cross-site scripting in WP Customer Area WordPress plugin CVSS 3.1HIGH 7.1
- TI-2026-85890 Stored cross-site scripting in WP Customer Area WordPress plugin CVSS 3.1MEDIUM 6.4
- TI-2026-83313 Cross-site scripting in WordPress WP Customer Area plugin CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-3464 · CVE Program
- CVE-2026-3464 · NVD
- FIRST EPSS
- GHSA-9859-fqhx-279v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences