CVE-2026-107594

Deferred Deferred - Pending Action

Unauthenticated File Deletion in File Upload to Order WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107594

EUVD

EUVD-2026-100893

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	File	Upload to Order 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WordPress plugin 'File Upload to Order' before version 1.1.4. It allows unauthenticated attackers to delete arbitrary files on the server by exploiting improper validation of file paths taken from attacker-controlled session data. This flaw can lead to full site compromise if critical files are removed.

Detection Guidance

Check if the File Upload to Order WordPress plugin version is below 1.1.4. Inspect server logs for unauthorized file deletion attempts or unusual session activity. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to delete important files on your server, potentially causing the website to crash or become fully compromised. This includes files critical to the site's operation or security.

Compliance Impact

This vulnerability could lead to full site compromise by allowing deletion of critical files, which may result in unauthorized access to sensitive data. For GDPR, this could mean breaches of personal data requiring notification under Article 33. For HIPAA, it might expose protected health information, violating safeguards under the Security Rule.

Mitigation Strategies

Update the File Upload to Order plugin to version 1.1.4 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied.

Hi! I’m here to help you understand CVE-2026-107594. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70