EUVD-2026-92262
GHSA-cm5p-rq6h-fw4h
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote access (PR:N, AV:N) but AC:H because the attacker must guess a specific file name; confidentiality-only impact (C:H, I:N/A:N) as files can be read not altered.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
6DescriptionCVE.org
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.
AnalysisAI
Unauthenticated disclosure of other customers' uploaded files is possible through the File Uploads Addon for WooCommerce WordPress plugin in versions 1.7.2 through 1.7.5, because the plugin serves stored uploads without verifying that the requester is the customer who originally uploaded the file (CWE-639). An attacker who knows or guesses the exact file name of a previously uploaded file can retrieve it over the network with no account and no user interaction, as reflected by CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9 Medium) - the High attack complexity stems entirely from the file-name discovery prerequisite, so real-world difficulty hinges on whether the plugin generates guessable or sequential names versus long random tokens. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to know or correctly guess the file name of a file previously uploaded by another customer through the File Uploads Addon for WooCommerce; the plugin serves that file without verifying ownership. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity information-disclosure flaw (CVSS 5.9) that should be treated as a real-but-moderate priority rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the File Uploads Addon for WooCommerce plugin to version 1.7.6 or later, which is the fixed release identified in the source data; verify the update through the WordPress admin plugin screen or WP-CLI and confirm the installed version afterward, since the plugin is a third-party addon and may not be covered by automated core updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today