EUVD-2026-96794
GHSA-hxhg-9p9q-54v7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber-level account
-
DeliveryCall unprotected bridge-install endpoint
-
ExploitSupply attacker-controlled archive URL
-
ExecutionPlugin downloads and extracts PHP into webroot
-
ImpactExecute planted webshell for RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account at Subscriber level or above on the target WordPress site (PR:L), so exploitation is gated by whether the site permits open/self-service registration or the attacker can otherwise obtain a low-privilege account. Beyond that there are no special configuration prerequisites: the remote bridge-installation process lacks an authorization/capability check and performs no validation of the supplied download URL, so any eligible user can point it at an attacker-controlled archive against a default install of Veeqo for WooCommerce ≤2.2.8. The practical limiting factor is account availability and the plugin being installed and active; no user interaction and no elevated privileges are needed. |
| Impact | Signals conflict sharply here. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) rates this as a low-severity information-style issue with only limited confidentiality impact, yet the description describes downloading and extracting an attacker-controlled archive of arbitrary PHP files into the WordPress root - which is effectively authenticated remote code execution and should carry High integrity/availability impact. This impact under-scoring is the single most important caveat: treat the published 4.3 as an undercount and the real-world impact as critical (webshell / full site takeover). Exploitability signals are moderate: network vector, low attack complexity, no user interaction, and only Subscriber-level privileges (PR:L) are required, which is a very low bar on any WordPress site allowing self-registration. Public exploit code exists (WPScan), raising practical risk, but CISA SSVC marks Exploitation as 'none' (no observed in-the-wild activity) and Automatable 'no', and there is no CISA KEV listing and no EPSS value supplied. Net: this is a genuine priority for any site running this plugin with open or low-trust registration, driven by the RCE impact and public POC - not a high-CVSS-but-low-risk case - but widespread opportunistic exploitation is not yet evidenced. |
| Exploit ScenarioDerived | An attacker registers (or obtains) a Subscriber-level account on a WordPress site running Veeqo for WooCommerce ≤2.2.8, then invokes the unprotected remote bridge-installation endpoint supplying a URL to an attacker-hosted ZIP archive. The plugin downloads and extracts the archive - containing malicious PHP files - into the WordPress root, giving the attacker a webshell and remote code execution. A public proof-of-concept is available from WPScan, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Authenticated users holding only Subscriber-level access can abuse the Veeqo for WooCommerce WordPress plugin (all versions through 2.2.8) to make the site download and extract an attacker-controlled archive, dropping arbitrary PHP files into the WordPress root and converting a low-privilege account into remote code execution; publicly available exploit code exists. The plugin's remote bridge-installation routine performs neither a capability check nor any validation of the URL it is given, and the attack needs no user interaction - the practical gate is simply having an account on the target site (e.g. open self-service registration) and the plugin being installed and active. Note that the widely published CVSS 4.3 score reflects confidentiality-only impact and understates the flaw; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while CISA's SSVC decision data records no observed exploitation and marks the issue non-automatable.
RemediationAI
No vendor-released patch or fixed version is identified in the available data - the flaw is documented as affecting all releases through 2.2.8, so the first action is to check the WPScan advisory at https://wpscan.com/vulnerability/09517757-2f99-42d5-8300-e1f618373059/ (mirrored context at https://vuldb.com/vuln/416544 and https://nvd.nist.gov/vuln/detail/CVE-2026-93550) for a newly published fixed version and upgrade the plugin as soon as one exists. Until a patch ships, the highest-fidelity mitigation is to deactivate and, ideally, delete the Veeqo for WooCommerce plugin from any site that is not actively using it; the trade-off is loss of the Veeqo/WooCommerce inventory-sync functionality. If the plugin must stay active, close the account-availability gap that gates exploitation: disable open/self-service WordPress registration, remove or downgrade unused Subscriber accounts, and enforce least privilege so that no low-privilege user can reach the plugin's bridge-installation endpoint - noting that this only narrows the attack surface and does not fix the missing authorization check, so any existing Subscriber (or an attacker who registers via a separate membership integration) remains a viable vector. On the host side, block or tightly allowlist outbound HTTP/HTTPS from the WordPress server so it cannot fetch archives from arbitrary attacker-controlled hosts (side effect: may break legitimate plugin updates, telemetry, and payment/Veeqo API callbacks), and apply file-integrity monitoring with alerting on new or modified .php files in the WordPress root and wp-content directories, which detects a successful drop but does not prevent it. Because public exploit code is available, prioritize inventorying exposed sites running the plugin and treat any low-privilege account creation followed by a bridge-installation request as a compromise indicator; there is no reliable evidence of in-the-wild exploitation at this time (SSVC records Exploitation: none).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type) realized through an unsafe remote-installation workflow inside a WordPress plugin. Veeqo for WooCommerce exposes a 'bridge installation' endpoint that accepts an attacker-supplied URL, fetches the referenced archive server-side, and extracts its contents into the WordPress document root - a directory that is directly web-accessible and executed by the PHP interpreter. Two defensive layers are absent: there is no capability/authorization check (no current_user_can() guard limiting the action to administrators, so any authenticated Subscriber can invoke it) and no validation or allowlisting of the destination URL, which additionally opens the server to server-side request forgery and to fetching content from arbitrary hosts. Because extraction is not constrained to a plugin-owned directory or to safe file types, an archive containing .php files lands in the web root and executes, and archive-extraction routines of this kind are also commonly susceptible to path-traversal ('zip slip') entry names. The affected component is versioned in the CPE dictionary as cpe:2.3:a:unknown:veeqo_for_woocommerce:*:*:*:*:*:*:*:* - note the vendor field is still recorded as 'unknown', meaning the CPE identifier is not yet normalized against a confirmed vendor namespace, so defenders should match on the plugin slug rather than relying on CPE lookups alone. EUVD enumerates the affected range as 'Veeqo for WooCommerce 0 ≤ 2.2.8', i.e. every release up to and including 2.2.8.
Know when Veeqo For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Subscriber-level auth gives PR:L; network, low-complexity, no-interaction extraction of arbitrary PHP into webroot yields RCE, so C/I/A all High.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB