What is the CVSS score of CVE-2026-42725?

CVE-2026-42725 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Checkout Files Upload WooCommerce CVE-2026-42725

EUVD-2026-32182 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-27 audit@patchstack.com

GHSA-8fmr-v9g7-jcmf

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:40 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

MEDIUM 6.5

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Files Upload for WooCommerce: from n/a through <= 2.2.5.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the WP Wham Checkout Files Upload for WooCommerce WordPress plugin exposes uploaded checkout files to unauthenticated remote attackers who manipulate user-controlled object keys. All plugin versions through 2.2.5 are affected, with the CVSS vector confirming no authentication or user interaction is required. Despite the straightforward exploit path - flagged as automatable by the SSVC framework - real-world risk is tempered by a very low EPSS score of 0.04% (12th percentile), no public exploit code, and no active exploitation per CISA KEV.

Technical ContextAI

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), the formal categorization for IDOR weaknesses. The plugin extends WooCommerce by allowing customers to attach files during the checkout process. The root cause is that object references used to retrieve or interact with these uploaded files can be directly controlled by the requesting party without server-side authorization validation - meaning a caller can substitute another customer's file identifier and the server fulfills the request without verifying ownership. The affected product is the 'checkout-files-upload-woocommerce' WordPress plugin by WP Wham, all releases from initial availability through version 2.2.5, as confirmed by Patchstack (ENISA EUVD-2026-32182).

RemediationAI

The primary remediation is to update the Checkout Files Upload for WooCommerce plugin beyond version 2.2.5 via the WordPress admin plugin dashboard or WP-CLI. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/checkout-files-upload-woocommerce/vulnerability/wordpress-checkout-files-upload-for-woocommerce-plugin-2-2-5-insecure-direct-object-references-idor-vulnerability should be monitored for the confirmed fixed version, as no exact patched release number was independently confirmed in available source data - the fix version is unverified at time of analysis. If immediate patching is not possible and the site handles sensitive customer documents, a compensating control is to disable the file upload feature entirely within the plugin settings, eliminating the attack surface at the cost of that checkout functionality. Restricting access to the plugin's file-handling endpoints via a WAF rule blocking unexpected object reference patterns (e.g., sequential integer IDs in file fetch requests) can reduce automated enumeration risk but does not constitute a full fix and may break legitimate functionality.