What is the CVSS score of CVE-2026-28171?

CVE-2026-28171 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Woocommerce File Approval are affected by CVE-2026-28171?

The WooCommerce File Approval plugin versions 10.7 and earlier contain a critical unauthenticated arbitrary file deletion vulnerability affecting any WordPress site using this plugin.

How to fix or mitigate CVE-2026-28171?

Within 24 hours: Scan all WordPress instances for WooCommerce File Approval plugin versions 10.7 and earlier; immediately disable and remove the plugin from production, staging, and development environments. Implement WAF rules to deny POST requests to the plugin's file handling endpoints. Within 7 days: Audit affected server filesystems for unauthorized deletions; configure enhanced logging and alerts on file deletion attempts targeting web-accessible directories; review backup integrity and restoration procedures. Within 30 days: Deploy a replacement file management plugin with equivalent functionality, or monitor vendor advisory channels for patch release information. Maintain an inventory of all previously affected systems with remediation completion dates.

Woocommerce File Approval CVE-2026-28171

EUVD-2026-64797 HIGH

Path Traversal (CWE-22)

2026-08-24 Patchstack

GHSA-784m-7h8q-73r2

Path Traversal WordPress Woocommerce File Approval

8.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 12:31 vuln.today

CVE Published

Aug 24, 2026 - 11:54 cve.org

HIGH 8.6

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.

AnalysisAI

Unauthenticated arbitrary file deletion in WooCommerce File Approval plugin (versions through 10.7) allows any remote attacker to delete arbitrary files on the underlying server without credentials or user interaction. The path traversal root cause (CWE-22) enables attackers to escape the plugin's intended file handling scope, with the CVSS S:C scope-change indicator confirming that files outside the plugin's own directory — including WordPress core files, configuration files, or OS-level files accessible to the web server process — can be targeted. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Scan all WordPress instances for WooCommerce File Approval plugin versions 10.7 and earlier; immediately disable and remove the plugin from production, staging, and development environments. …

Threat intelligence, references, and detailed analysis are available after sign-in.