Zero-day path traversal in Addify Tax Exempt for WooCommerce
A previously undisclosed, unpatched path traversal vulnerability in Addify Tax Exempt for WooCommerce, reported through the Patchstack Bug Bounty Program on May 27, 2026 - before any advisory, fix, or CVE existed. An authenticated, customer-level account could access private files stored elsewhere on the server. Fixed in version 1.9.5.
Vulnerability analysis
The flaw is a failure to properly limit a pathname to a restricted directory (CWE-35, Path Traversal: ‘.../...//’). The vector defines the exposure precisely: the vulnerability is remotely exploitable over the network (AV:N) at low attack complexity (AC:L), requires only low privileges (PR:L) - Patchstack specifies customer-level access - and requires no user interaction (UI:N). Scope is unchanged (S:U).
The scored impact is confined to confidentiality, rated high (C:H): the primitive is unauthorized file access beyond the restricted directory. Integrity and availability impacts are not scored (I:N, A:N). In operational terms, the precondition is the least privileged account class a WooCommerce store issues in normal operation, and no action by any other user is required to exercise the flaw.
Severity assessment
The 6.5 base score is a correct application of the CVSS formula to the scored metrics, and it should be read as such: exploitability is high, but with confidentiality as the sole scored impact, the base calculation resolves to Medium. Base scoring is, by design, an assessment of the vulnerability in isolation. It does not incorporate environmental variables: the sensitivity of the files resident on a production WooCommerce host, the fact that tax-exemption tooling operates adjacent to a business’s tax documentation and customer records, or the utility of a reliable file-read primitive as an initial stage in a longer intrusion. The research submission documented additional vectors that a base score does not aggregate.
CISA’s SSVC assessment at publication recorded exploitation as “none,” automatable as “no,” and technical impact as “partial,” as of July 2, 2026 - a point-in-time assessment of exploitation status, not a measure of the flaw’s ceiling.
Validation methodology
The finding was established through AI-assisted source review of version 1.9.3, followed by live validation of the behavior in that version, with both stages documented in the retained evidence record. Version 1.9.3 is the validated version specifically; it does not bound the affected range, which the published record sets at all versions before 1.9.5.
Disclosure and remediation
The finding was disclosed privately through Patchstack’s Bug Bounty Program and published only after a fixed version existed. The report preceded the vendor’s remediation guidance, the Patchstack advisory (June 29, 2026), and the CVE itself (reserved June 1, published July 2, 2026), which is what makes it a zero-day discovery: at the time of reporting, the vulnerability was neither publicly disclosed nor patched. Site owners remediate by updating to version 1.9.5 or later; Patchstack additionally issued a mitigation rule for its users and advises resolving the vulnerability immediately.
Material withheld from this write-up
Endpoint-level reproduction detail and the file-handling internals are deliberately withheld. The plugin’s installed base includes businesses that handle sensitive tax documentation, and the extended window gives remaining operators additional time to apply the published fix before reproduction material circulates. The full technical account will be added to this page at a later date. Nothing required for remediation is withheld: the affected range, fixed version, and advisory have been public since June 29, 2026.