What is the CVSS score of CVE-2026-6802?

CVE-2026-6802 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Easy Upload Files During Checkout CVE-2026-6802

EUVD-2026-42846 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 Wordfence

GHSA-hwwr-5j3w-9mfq

WordPress Authentication Bypass Wordpress Plugin Easy Upload Files During Checkout Fahadmahmood

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible with no authentication required; A:L added to vendor scoring because permanent media deletion makes those assets unavailable, not merely altered.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 09:24 vuln.today

CVE Published

Jul 10, 2026 - 07:48 nvd

MEDIUM 5.3

DescriptionCVE.org

The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1. This is due to missing authorization checks in the ufdc_custom_init() function, which processes the 'eufdc-delete' parameter without any nonce verification, capability check, or attachment ownership validation. This makes it possible for unauthenticated attackers to permanently delete arbitrary media library attachments from the WordPress site.

AnalysisAI

Unauthenticated media library attachment deletion affects the Easy Upload Files During Checkout WordPress plugin through version 3.0.1, enabling any remote visitor to permanently destroy arbitrary files from the site's media library with no credentials. The root cause is CWE-639: the ufdc_custom_init() hook processes a user-controlled 'eufdc-delete' parameter without nonce verification, capability checks, or attachment ownership validation, reducing authorization to a trivial parameter-guessing exercise against sequential WordPress attachment IDs. No public exploit code or CISA KEV listing has been identified, but the attack requires zero prerequisites beyond plugin presence, making it trivially reproducible.

Technical ContextAI

The affected product is the Easy Upload Files During Checkout WordPress plugin by fahadmahmood (CPE: cpe:2.3:a:fahadmahmood:easy_upload_files_during_checkout:*:*:*:*:*:*:*:*), a WooCommerce extension that allows customers to attach files during the checkout flow. CWE-639 (Authorization Bypass Through User-Controlled Key) is the root cause class: the ufdc_custom_init() initialization hook accepts a user-supplied 'eufdc-delete' parameter - presumed to be a WordPress attachment post ID - and routes it to a deletion routine across multiple code paths in inc/functions.php (lines 195, 561, and 587 in the 3.0.1 tag). WordPress core provides well-established authorization primitives - current_user_can() for capability gating, wp_verify_nonce() for request integrity - that are entirely absent from this handler, allowing any caller to delete any attachment by supplying its integer ID. Since WordPress attachment IDs are sequential and discoverable through public pages, oEmbed endpoints, or HTML source scraping, the authorization bypass degrades to simple integer enumeration.

RemediationAI

A fix has been committed to the plugin's trunk branch in the WordPress plugin repository (changeset 3522887, visible at https://plugins.trac.wordpress.org/changeset?reponame=&old=3522887%40easy-upload-files-during-checkout&new=3522887%40easy-upload-files-during-checkout); however, a patched tagged release with a version number beyond 3.0.1 is not independently confirmed from the available data. Administrators should monitor the WordPress plugin repository for a new tagged release and apply it immediately upon availability. As an immediate compensating control, deactivating the plugin eliminates the attack surface entirely, though this disables file attachment functionality during WooCommerce checkout. Alternatively, a WAF or server-level rule blocking HTTP requests containing the 'eufdc-delete' parameter targeting WordPress frontend endpoints can prevent exploitation while preserving plugin functionality, with the trade-off of introducing dependency on WAF coverage completeness. Restricting media library contents to non-sensitive assets reduces business impact but does not prevent the attack from succeeding.