WP Customer Area Plugin: Arbitrary File Read/Delete Exposes WordPress

The National Vulnerability Database has disclosed CVE-2026-3464, a critical vulnerability affecting the WP Customer Area plugin for WordPress. This flaw, present in all versions up to 8.3.4, stems from insufficient file path validation within the ajax_attach_file function. Its high CVSS score of 8.8 reflects the severe impact.

Authenticated attackers, even with low-privileged roles like a Subscriber (if granted access by an administrator), can exploit this. They can read arbitrary files on the server, potentially exfiltrating sensitive configuration data or user information. Worse, they can delete arbitrary files, which is a direct path to remote code execution. Deleting wp-config.php, for instance, can trigger installation prompts, allowing an attacker to seize control.

This isn’t just a data leak; it’s a full system compromise waiting to happen. Defenders running WordPress with this plugin must understand that even seemingly low-privileged accounts become potent weapons when this vulnerability is present. The attacker’s calculus here is simple: gain a foothold, escalate privileges by deleting a key file, and execute arbitrary code. It’s a clear path to owning the server.