CVE-2026-103688
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 allows unauthenticated users to upload arbitrary files, including PHP files, leading to remote code execution on servers that execute PHP from the uploads directory.
- Affected
- {'products': ['WooCommerce WordPress plugin'], 'packages': [], 'versions': ['before 2.4.0']}
- Fix
- Upgrade to version 2.4.0 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.
Last activity 28 Oct 2026. Patch Forecast updates every hour.