CVE-2026-13607

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: WPScan

Description

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-13607

EUVD

EUVD-2026-92261

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	File	Uploads Addon for WooCommerce 1.7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the File Uploads Addon for WooCommerce WordPress plugin versions up to 1.7.6. It allows unauthenticated attackers to directly access customer-uploaded files stored in a public directory by guessing or knowing the file name. The plugin's intended access restrictions fail to prevent this unauthorized access.

Detection Guidance

Check if customer-uploaded files are stored in a publicly accessible directory by attempting to access files directly via URL. Look for directories like /wp-content/uploads/ or similar paths where files might be stored. Verify if the plugin's access restrictions are bypassed by testing unauthenticated file retrieval.

Impact Analysis

An attacker could retrieve sensitive customer-uploaded files without authentication. This may lead to exposure of private data, financial documents, or other confidential information stored in those files. The impact includes potential data breaches and loss of customer trust.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other privacy regulations due to unauthorized access to personal or sensitive data. Organizations may face legal penalties, fines, and reputational damage if customer data is exposed through this flaw.

Mitigation Strategies

Update the File Uploads Addon for WooCommerce plugin to the latest version if available. Restrict direct access to the uploads directory by configuring server rules to block unauthorized access. Implement proper authentication checks for file downloads.

Hi! I’m here to help you understand CVE-2026-13607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70