CVE-2026-107594
File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
- State
- Published
- Severity
- 10.0 Critical
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 8, 2026
Description
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
File Upload to OrderUnknown |
|
References
- https://wpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.