What is the CVSS score of CVE-2026-16054?

CVE-2026-16054 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Drag and Drop Multiple File Upload for WooCommerce are affected by CVE-2026-16054?

A critical vulnerability in the Drag and Drop Multiple File Upload for WooCommerce plugin (versions before 1.1.8) allows any internet user to delete customer order attachments, with publicly…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16054?

Yes, a public proof-of-concept exploit is available for CVE-2026-16054. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16054?

Within 24 hours, update the Drag and Drop Multiple File Upload for WooCommerce plugin to version 1.1.8 or later across all WooCommerce instances and verify the update applied successfully. Within 7 days, audit server logs and backup systems for evidence of unauthorized file deletion, restore any compromised customer order attachments, and communicate with affected customers about the vulnerability window and any data loss discovered. Within 30 days, conduct a complete incident assessment covering the full period the plugin was vulnerable, implement file integrity monitoring on upload directories, and review all remaining nonce-based security controls for similar weaknesses.

Drag and Drop Multiple File Upload for WooCommerce CVE-2026-16054

EUVD-2026-53722 CRITICAL

External Control of File Name or Path (CWE-73)

2026-08-06 WPScan

GHSA-cjxx-cx63-pfpq

WordPress File Upload Drag And Drop Multiple File Upload For Woocommerce Unknown

9.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Nonce obtainable by anonymous users gives PR:N/UI:N over the network at low complexity; file destruction yields I:H and A:H with no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 22:22 vuln.today

CVSS changed

Aug 06, 2026 - 22:22 NVD

9.1 (CRITICAL)

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

CRITICAL 9.1

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

Articles & Coverage 1

News Critical Arbitrary File Deletion in WordPress WooCommerce File Upload Plugin - CVE-2026-16054 Aug 07, 2026

AnalysisAI

Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.

Technical ContextAI

The affected component is a WordPress e-commerce extension that adds drag-and-drop multi-file upload capability to WooCommerce order/checkout flows, storing customer-supplied attachments in a plugin-managed upload directory (CPE cpe:2.3:a:unknown:drag_and_drop_multiple_file_upload_for_woocommerce). The root cause maps to CWE-73 (External Control of File Name or Path): a file-deletion AJAX/handler routine is gated solely by a WordPress nonce, which is intended as a CSRF token rather than an authorization control. Because the plugin exposes or generates a valid nonce to unauthenticated requests, an anonymous actor can satisfy the only guard and pass an attacker-influenced target into the delete operation, removing files that should be protected.

RemediationAI

Vendor-released patch: upgrade the plugin to version 1.1.8 or later, which is the primary and recommended fix (advisory: https://wpscan.com/vulnerability/3be51346-5d4c-4889-bc5c-f40749bd182a/, NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16054). If immediate patching is not possible, deactivate the Drag and Drop Multiple File Upload for WooCommerce plugin until it can be updated - the trade-off is loss of customer file-upload functionality on checkout/order forms. As additional interim controls, restrict access to the plugin's AJAX/delete endpoint via a WAF rule or web-server access rules and ensure regular backups of the plugin upload directory so destroyed order attachments can be restored; note that WAF filtering may generate false positives on legitimate upload traffic and must be tuned. Because the flaw is destructive rather than confidentiality-impacting, prioritize backup/restore readiness alongside the upgrade.