by Kastro
Paper/Archive/CVE-2026-107594

CVE-2026-107594

Unknown File Upload to Order — File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion

EPSS 0.5%CVSS 10.0
critical.is priorityof 100
38
CVSS 10.0 (ADP)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 39.9.399 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

Affected

ProductAffectedFixed inSource
File Upload to Order< 1.1.41.1.4CNA

Scores by source

CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

exploitwpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76