Easy Upload Files During Checkout CVE-2026-6802

The Easy Upload Files During Checkout plugin must be installed and active on the target WordPress installation running version 3.0.1 or earlier - no special plugin configuration or non-default settings are required. The CVSS vector (PR:N/UI:N) and CVE description jointly confirm that exploitation requires no authentication and no user interaction; any remote, unauthenticated HTTP client can trigger deletion. The attacker must supply a valid WordPress attachment post ID as the 'eufdc-delete' parameter, but these IDs are sequential integers trivially discoverable via public site pages, making targeted enumeration practical. Exploitation is strictly limited to WordPress sites running this specific plugin; the vulnerability does not affect WordPress core or other plugins.

The vendor-assigned CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the network-accessible, zero-authentication delivery, but the I:L/A:N impact assignment arguably understates real-world consequences: permanent and irreversible deletion of media library content could plausibly be scored A:L as well, since destroyed product images, customer receipts, or document uploads are no longer available. No EPSS score was provided in the available data, and the vulnerability does not appear in the CISA KEV catalog - suggesting exploitation has not been observed at scale as of analysis time. No public proof-of-concept code is referenced. Despite the absence of known active exploitation, the attack complexity is genuinely minimal: the parameter interface is public-facing, IDs are enumerable, and no authentication or special tool is required. Real-world risk priority should be driven by site-specific reliance on media library integrity rather than the raw CVSS score; sites using this plugin for WooCommerce checkout attachments face disproportionate business impact relative to the medium severity label.

An unauthenticated attacker visits any page on the target WordPress site that fires the ufdc_custom_init() hook and appends the 'eufdc-delete' parameter set to an integer attachment ID - for example, submitting a request such as GET /?eufdc-delete=42. Because WordPress attachment IDs are sequential integers widely exposed through page source, RSS feeds, and oEmbed endpoints, the attacker can enumerate and permanently destroy product images, customer-uploaded checkout files, or other media library content using nothing more than a basic HTTP client or browser. No public exploit code is currently referenced, but reproduction requires no specialized tooling or credentials.