Order Tip WooCommerce EUVD-2026-66283

Exploitation requires an authenticated WordPress user with at least the Shop Manager role - a non-default, privileged role granted via WooCommerce. This role is commonly assigned to store staff, making the threat most realistic from a malicious insider or a compromised Shop Manager account. No special plugin configuration or non-default WordPress setting is required beyond the plugin being installed and active with a Shop Manager account in existence. Exploitation is limited to the permissions of the web server process user for file deletion scope. The absence of UI:N and authentication requirements mean no victim interaction is needed once credentials are obtained, but the PR:H requirement rules out unauthenticated or low-privilege exploitation. SSVC confirms the attack is not automatable, consistent with the manual credential prerequisite.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) scores 8.7 and reflects that exploitation requires High Privileges (PR:H - a Shop Manager account), which is the primary limiting factor. The Scope:Changed metric is well-justified because the plugin's destructive action reaches beyond its own scope into WordPress core and potentially the OS filesystem. The absence of a Confidentiality impact (C:N) is also accurate - this is a destructive write-path flaw, not a data exfiltration flaw. Against these signals, EPSS at 0.17% (6th percentile) indicates very low community-wide exploitation probability, aligning with the SSVC assessment of Exploitation: none and Automatable: no. The POC being publicly available elevates concern for insider-threat scenarios (rogue shop manager) or post-compromise pivot (compromised shop manager credentials as an entry point). Real-world priority is moderate: a high CVSS score is warranted by the potential for full site takeover, but the PR:H requirement means unauthenticated mass exploitation is not a realistic threat vector at this time.

A threat actor who has obtained Shop Manager credentials - through phishing, credential stuffing, or a rogue employee - logs into the WordPress admin panel and sends a crafted HTTP request to the plugin's file deletion endpoint, specifying a path such as wp-config.php or .htaccess rather than a legitimate tip-related file. Because the plugin performs no capability check or path validation, the web server process deletes the target file, taking the site offline or exposing it to further compromise. A public proof-of-concept exists per WPScan, lowering the technical bar for this scenario.