File Upload To Order
Monthly
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.