EUVD-2026-64797
GHSA-784m-7h8q-73r2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Unauthenticated arbitrary file deletion in WooCommerce File Approval plugin (versions through 10.7) allows any remote attacker to delete arbitrary files on the underlying server without credentials or user interaction. The path traversal root cause (CWE-22) enables attackers to escape the plugin's intended file handling scope, with the CVSS S:C scope-change indicator confirming that files outside the plugin's own directory — including WordPress core files, configuration files, or OS-level files accessible to the web server process — can be targeted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the zero-complexity, unauthenticated attack surface makes this a high-priority remediation target for any site running the affected plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Woocommerce File Approval gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
Executive ViewAI
The WooCommerce File Approval plugin versions 10.7 and earlier contain a critical unauthenticated arbitrary file deletion vulnerability affecting any WordPress site using this plugin. Attackers can delete critical website files including WordPress core, configuration files, and data without requiring credentials, potentially causing site downtime and data loss. Organizations must treat this as an immediate remediation priority for all affected deployments.
Within 24 hours: Scan all WordPress instances for WooCommerce File Approval plugin versions 10.7 and earlier; immediately disable and remove the plugin from production, staging, and development environments. Implement WAF rules to deny POST requests to the plugin's file handling endpoints. Within 7 days: Audit affected server filesystems for unauthorized deletions; configure enhanced logging and alerts on file deletion attempts targeting web-accessible directories; review backup integrity and restoration procedures. Within 30 days: Deploy a replacement file management plugin with equivalent functionality, or monitor vendor advisory channels for patch release information. Maintain an inventory of all previously affected systems with remediation completion dates.
Disable and remove the vulnerable plugin (primary mitigation). Implement strict file permissions restricting web server process write access to essential directories only. Deploy Web Application Firewall rules blocking requests to /wp-content/plugins/file-approval/ endpoints. Enable file integrity monitoring on critical WordPress directories. Maintain current, tested backups stored separately from the live environment with validated restore procedures. Implement access logging and alerting for file deletion operations at the OS level.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB