Read the docs
TI-2026-81679 Aliases CVE-2026-15323GHSA-23m5-26m5-cmpf

Path traversal in Lumise for WooCommerce lets attackers read files

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

King-Theme's Product Designer for WooCommerce WordPress | Lumise plugin is affected in all versions up to and including 2.1.2. A directory traversal flaw in the process_checkout function (CWE-22) lets unauthenticated remote attackers read the contents of arbitrary files on the server, which can contain sensitive information. No prior access or credentials are needed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumise_security nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00861 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
King-ThemeProduct Designer for WooCommerce WordPress | Lumiseup to 2.1.2—No fix listedCNA
  • Product Designer for WooCommerce WordPress | Lumise VendorKing-Theme Affected up to 2.1.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Product Designer for WooCommerce WordPress | Lumise.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-15323
  2. 2026-10-28 Alias added: GHSA-23m5-26m5-cmpf
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2020-12054 A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through… CVSS 3.1MEDIUM 6.1
  • TI-2026-20489 WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2020-18872 Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload CVSS 3.1HIGH 8.8
  • TI-2020-18871 Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control CVSS 3.1HIGH 8.8
  • TI-2026-08512 SQL injection in King-Theme Product Designer for WooCommerce WordPress | Lumise CVSS 3.1HIGH 7.5
  • TI-2022-00106 Page Builder KingComposer <= 2.9.6 - Open Redirect CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences