CVE-2026-107594
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path…
- Risk score
- 73/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files w…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.1.4 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
Last activity 14 Oct 2026. Patch Forecast updates every hour.