Drag and Drop Multiple File Upload for WooCommerce CVE-2026-16054

Exploitation requires only that the target WordPress site runs the Drag and Drop Multiple File Upload for WooCommerce plugin at a version before 1.1.8 with its file-upload/deletion functionality active; the attacker must first obtain the plugin-issued nonce, which the plugin exposes to unauthenticated users, so this is not a meaningful barrier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are needed beyond having the plugin installed. The main limiting factor is scope of impact rather than access: the attacker can only delete files within the plugin's own upload directory (pending order attachments), not arbitrary server files as far as the description states, and impact is destructive/availability-and-integrity only with no data disclosure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H, base 9.1) is internally consistent with the description: network-reachable, low-complexity, no authentication, no user interaction, with high integrity and availability impact from irreversible data destruction and no confidentiality loss. Signals conflict on urgency: exploitation is trivial and a public POC (WPScan) exists, yet EPSS is only 0.14% (4th percentile) and the CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at analysis time. No SSVC decision record was provided. Net assessment: technically a real, easy-to-exploit issue that warrants prompt patching, but current telemetry suggests it is not yet subject to mass automated attack - treat as high-priority for shops running this plugin rather than an emergency across the general population.

An anonymous attacker requests a page or endpoint that hands out the plugin's nonce, then replays that nonce to the file-deletion handler to remove attachments from the plugin's upload directory. Using the publicly available WPScan-documented exploit, they can script mass deletion of pending order attachments, irreversibly destroying files customers submitted with their orders. No login, user interaction, or elevated privileges are required.