Peprodev Woocommerce Receipt Uploader
Monthly
Unauthorized retrieval of other customers' payment receipt images is possible in PeproDev WooCommerce Receipt Uploader (≤ 2.8.0) because the plugin's token-based attachment access mechanism never validates that a requested attachment ID belongs to the order the token was issued for. Unauthenticated network attackers can forge or repurpose a token - trivially obtained by placing any order - to iterate over attachment IDs and exfiltrate payment receipts uploaded by unrelated customers, potentially exposing financial documents containing banking details or PII. A publicly available proof-of-concept exists per WPScan reporting (EUVD-2026-53719); no CISA KEV listing indicates widespread active exploitation has not been confirmed, though SSVC rates the attack as automatable.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.
Unauthorized retrieval of other customers' payment receipt images is possible in PeproDev WooCommerce Receipt Uploader (≤ 2.8.0) because the plugin's token-based attachment access mechanism never validates that a requested attachment ID belongs to the order the token was issued for. Unauthenticated network attackers can forge or repurpose a token - trivially obtained by placing any order - to iterate over attachment IDs and exfiltrate payment receipts uploaded by unrelated customers, potentially exposing financial documents containing banking details or PII. A publicly available proof-of-concept exists per WPScan reporting (EUVD-2026-53719); no CISA KEV listing indicates widespread active exploitation has not been confirmed, though SSVC rates the attack as automatable.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.