CVE-2026-32477
Received Received - Intake

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Patchstack

Description
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-32477
EUVD
EUVD-2026-64801

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
shopbuilder pro to 2.2.0 (inc)
patchstack shopbuilder_pro_elementor_woocommerce_builder_addons to 2.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated arbitrary file deletion flaw in the ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin for WordPress, affecting versions 2.2.0 and below. It allows attackers to delete files from the website without authentication, potentially causing site failure if critical files are removed.

Detection Guidance

To detect this vulnerability, check if the ShopBuilder Pro plugin version 2.2.0 or below is installed on your WordPress site. You can verify the plugin version by inspecting the plugin files or using WordPress admin panel under Plugins. No specific commands are provided in the context, but monitoring for unusual file deletions or unauthorized access attempts may indicate exploitation.

Impact Analysis

This vulnerability can lead to website downtime or failure if critical files are deleted. Attackers could exploit it to remove important data, disrupt services, or cause permanent damage to the site's functionality.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized file deletion. For GDPR, it may lead to data integrity issues or loss of personal data, violating Article 5 on data integrity. For HIPAA, unauthorized file deletion could compromise protected health information availability, violating the Security Rule's integrity and availability requirements.

Mitigation Strategies

Immediately disable or remove the ShopBuilder Pro plugin if it is version 2.2.0 or below. Apply Patchstack's mitigation rule to block attacks until an official patch is released. Contact your hosting provider or developer for assistance. Avoid using the plugin until an update is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32477. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart