CVE-2026-32415

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32415", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:11:19.857Z", "datePublished": "2026-03-13T11:42:15.203Z", "dateUpdated": "2026-04-29T09:51:59.409Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "squeeze", "product": "Squeeze", "vendor": "Bogdan Bendziukov", "versions": [{"changes": [{"at": "1.7.8", "status": "unaffected"}], "lessThanOrEqual": "1.7.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:06:10.565Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.<p>This issue affects Squeeze: from n/a through <= 1.7.7.</p>"}], "value": "Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.This issue affects Squeeze: from n/a through <= 1.7.7."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-35", "description": "Path Traversal: '.../...//'", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-29T09:51:59.409Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/squeeze/vulnerability/wordpress-squeeze-plugin-1-7-7-directory-traversal-vulnerability?_s_id=cve"}], "title": "WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T13:11:19.635052Z", "id": "CVE-2026-32415", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:13:32.052Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32415", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T13:11:19.635052Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:11:14.719Z"}}], "cna": {"title": "WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "Path Traversal"}]}], "affected": [{"vendor": "Bogdan Bendziukov", "product": "Squeeze", "versions": [{"status": "affected", "changes": [{"at": "1.7.8", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 1.7.7"}], "packageName": "squeeze", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-03-13T12:41:19.313Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/squeeze/vulnerability/wordpress-squeeze-plugin-1-7-7-directory-traversal-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.This issue affects Squeeze: from n/a through <= 1.7.7.", "supportingMedia": [{"type": "text/html", "value": "Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.<p>This issue affects Squeeze: from n/a through <= 1.7.7.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-35", "description": "Path Traversal: '.../...//'"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-13T11:42:15.203Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32415", "state": "PUBLISHED", "dateUpdated": "2026-03-17T13:13:32.052Z", "dateReserved": "2026-03-12T11:11:19.857Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-13T11:42:15.203Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "squeeze", "product": "Squeeze", "vendor": "Bogdan Bendziukov", "versions": [{"changes": [{"at": "1.7.8", "status": "unaffected"}], "lessThanOrEqual": "1.7.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.This issue affects Squeeze: from n/a through <= 1.7.7."}, {"lang": "es", "value": "Salto de ruta: La vulnerabilidad '.../...//' en Bogdan Bendziukov Squeeze squeeze permite el salto de ruta. Este problema afecta a Squeeze: desde n/d hasta &lt;= 1.7.7."}], "id": "CVE-2026-32415", "lastModified": "2026-06-17T10:35:46.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32415", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T13:11:19.635052Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:58.787", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/squeeze/vulnerability/wordpress-squeeze-plugin-1-7-7-directory-traversal-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-35"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.7]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[1.7.8,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Squeeze", "source": "cna", "vendor": "Bogdan Bendziukov"}, "product": "squeeze", "vendor": "bogdan_bendziukov"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T17:51:40.043265+00:00", "value": {"mitigation_remediation": ["Upgrade the Squeeze plugin to a version newer than 1.7.7, if an official patch is available from Bogdan Bendziukov.", "If an update is not available or cannot be applied immediately, consider disabling or removing the Squeeze plugin to prevent exploitation.", "Verify that the site is no longer accessible through the vulnerable endpoints to ensure the flaw has been mitigated."], "summary": {"action": "Patch", "impact": "Directory Traversal (File Disclosure)"}, "threat_synthesis": {"affected_systems": "The Squeeze plugin, versions from any initial release up to and including 1.7.7, is affected. No other products or versions are listed. The vendor is Bogdan Bendziukov, and the product name is Squeeze.", "description_and_impact": "This vulnerability is a directory traversal flaw in the Bogdan Bendziukov Squeeze WordPress plugin. Improper handling of path sequences such as \".../...//\" allows an attacker to read arbitrary files from the server filesystem, potentially exposing sensitive configuration, credential, or other confidential data. The weakness is classified as CWE-35, which focuses on incorrect path handling leading to unauthorized file disclosure.", "risk_and_exploitability": "The CVSS score for this vulnerability is 5, indicating moderate severity, and the EPSS score is lower than 1%, suggesting a low current probability of exploitation. This issue is not in the CISA KEV catalog. Based on the nature of the flaw, it is inferred that a remote attacker could trigger the vulnerability by submitting crafted path requests through the plugin\u2019s interface, which is typical for web\u2011based directory traversal vulnerabilities. Given the moderate CVSS, low EPSS, and lack of KEV listing, the overall risk is considered low to moderate, but file disclosure still warrants attention."}}}}, "created": "2026-03-16T09:33:57.304417+00:00", "updated": "2026-03-23T12:03:48.315072+00:00", "vendors": ["bogdan_bendziukov", "bogdan_bendziukov$PRODUCT$squeeze", "wordpress", "wordpress$PRODUCT$wordpress"]}