CVE-2026-3464

OVERVIEW CVE-2026-3464 affects the WP Customer Area plugin for WordPress through version 8.3.4. The vulnerability stems from insufficient file path validation in the 'ajax_attach_file' function, enabling authenticated attackers to read and delete arbitrary files on affected servers. This flaw poses a critical risk because deletion of essential files like wp-config.php can facilitate remote code execution. SEVERITY This vulnerability carries a CVSS v3.1 severity score of 8.8 (HIGH) due to its network-based attack vector, low complexity, and requirement for low privileges. The impact is severe across all three security dimensions: attackers can achieve high confidentiality impact through arbitrary file read operations, high integrity impact through file deletion, and high availability impact through system disruption. Notably, the vulnerability requires only authenticated access with minimal privileges, making it accessible to users with subscriber-level roles. EXPLOITATION STATUS Current exploitation activity remains minimal. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and scores low on exploit prediction metrics with an EPSS score of 0.003, indicating limited real-world exploitation to date. The vulnerability maintains an inactive status on security tracking lists, though the significant CVSS score and potential for privilege escalation warrant immediate patching of affected installations.