File Upload to Order EUVD-2026-100893

The File Upload to Order plugin (version before 1.1.4) must be installed and active on the target WordPress site. No authentication, user interaction, or non-default configuration is required: the deletion action is reachable by unauthenticated users (PR:N/UI:N), and the file path is read from attacker-controlled session data with no validation or path confinement (CWE-73). The only practical limiting factors are (1) the plugin must be present and (2) to escalate from file deletion to full site compromise the attacker must target a security-critical file such as wp-config.php; plain deletion of arbitrary files is otherwise unconditional.

Signals conflict and must be weighed carefully. The CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) reflects a genuinely severe primitive: unauthenticated, network-reachable arbitrary file deletion with a scope change, because deleting a sensitive file (e.g. wp-config.php) can cascade into full site takeover. SSVC corroborates this with Automatable:yes, though it rates Technical Impact only 'partial' (consistent with deletion/integrity rather than full code execution) and Exploitation:none (no observed in-the-wild activity). Countering the high severity, EPSS is only 0.19% (8th percentile) and the CVE is NOT on CISA KEV - so despite a publicly available WPScan exploit, there is no evidence of active mass exploitation yet. The EPSS-vs-severity gap is best explained by the plugin's limited install base rather than any flaw in the CVSS rating: a perfectly exploitable bug in a low-prevalence product yields few real-world targets. Net: this is a real, high-priority issue for any site actually running File Upload to Order before 1.1.4 (patch immediately), but it is not a broad internet-wide emergency. Automatable:yes plus public POC means opportunistic scanning is plausible, so treat exposed installs as urgent.

An unauthenticated attacker interacts with the plugin to seed a crafted file path into their session data, then invokes the publicly reachable deletion action, which removes the targeted file without path validation. By deleting wp-config.php (or another critical file), the attacker forces WordPress into its setup/install state and can reconfigure the site against an attacker-controlled database, achieving full compromise. A public exploit for this exact flaw is available from WPScan, lowering the skill required.