EUVD-2026-66283
GHSA-6vg6-hvwg-vvx8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
PR:H reflects mandatory Shop Manager authentication; S:C applies because file deletion reaches beyond the plugin into WordPress core and the server filesystem.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over.
AnalysisAI
Arbitrary file deletion in the Order Tip for WooCommerce WordPress plugin (versions before 1.6.0) allows authenticated Shop Managers to delete any file on the web server by exploiting missing capability checks and absent path restrictions on the deletion endpoint. The plugin fails to validate both the requesting user's permissions and the target file path, meaning a malicious or compromised Shop Manager account could remove critical WordPress files such as wp-config.php, leading to full site compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user with at least the Shop Manager role - a non-default, privileged role granted via WooCommerce. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) scores 8.7 and reflects that exploitation requires High Privileges (PR:H - a Shop Manager account), which is the primary limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor who has obtained Shop Manager credentials - through phishing, credential stuffing, or a rogue employee - logs into the WordPress admin panel and sends a crafted HTTP request to the plugin's file deletion endpoint, specifying a path such as wp-config.php or .htaccess rather than a legitimate tip-related file. Because the plugin performs no capability check or path validation, the web server process deletes the target file, taking the site offline or exposing it to further compromise. … |
| Remediation | The primary fix is to upgrade the Order Tip for WooCommerce plugin to version 1.6.0 or later, which introduces proper capability verification and path restriction on the file deletion endpoint, as documented in the WPScan advisory at https://wpscan.com/vulnerability/630de65a-d3ca-4690-a21a-985616ebfad1/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify sites running Order Tip for WooCommerce versions prior to 1.6.0 and enumerate which accounts hold Shop Manager privileges; notify relevant teams immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today