Summary
CVE-2026-14327 is a high-severity Directory Traversal vulnerability (CWE-22) in the AR for WordPress plugin (by webandprint), affecting all versions up to and including 8.40. Unauthenticated remote attackers can exploit insufficient path validation in the plugin’s secure model download endpoint to read the contents of arbitrary files on the server. The CVSS v3.1 base score is 7.5 (High), reflecting fully unauthenticated, low-complexity network exploitation with high confidentiality impact and no integrity or availability impact.
Technical details
- Root cause: The plugin’s secure model download endpoint processes a
fileparameter without adequate path validation, allowing directory traversal sequences to escape the intended file scope. The encryption key protecting this endpoint is derived from the plugin’s licence key (ar_licence_key), which defaults to unset on all free and unlicensed installations — making the key locally reproducible by any unauthenticated attacker. - Trigger conditions: An attacker must first obtain a valid nonce by calling two publicly accessible, no-privilege-required (
nopriv) WordPress AJAX handlers:ar_get_fresh_nonceandar_process_user_image. Both steps require no credentials and are fully achievable against any default free or unlicensed installation. - Attack vector: Remote, unauthenticated, over the network. No user interaction is required. Despite the multi-step exploitation chain — nonce retrieval via the nopriv AJAX handlers, local reproduction of the encryption key, and submission of a traversal-crafted
fileparameter — the attack is classified low complexity (AC:L) because all steps succeed on any default installation wherear_licence_keyis unset. - Impact: Successful exploitation enables an attacker to read arbitrary files from the server filesystem, including sensitive files such as
wp-config.php(containing database credentials and authentication keys), private key material, and environment configuration files. Exposure of these files can facilitate further compromise of the hosting environment.
Affected software
- AR for WordPress plugin (vendor: webandprint) — all versions from initial release through 8.40 (inclusive)
Severity
- CVSS v3.1 Base Score: 7.5 (High)
- Vector string:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Update the AR for WordPress plugin to version 8.41 or later. Version 8.41 addresses this vulnerability by fixing directory traversal in the secure model download endpoint, deriving secure download encryption from a plugin-managed secret instead of the licence key, restricting secure downloads to model files under the uploads directory with strict path validation, and using a dedicated download nonce separate from other AJAX handlers.
- If immediate patching is not possible: Restrict access to the plugin’s nopriv AJAX handlers (
ar_get_fresh_nonce,ar_process_user_image) via web application firewall rules or server-level access controls to reduce the exploitation surface until the update can be applied.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.