CVE-2026-24625
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-01-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| imaginate_solutions | woo-addon-uploads | to 1.7.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in the WordPress File Uploads Addon for WooCommerce Plugin (versions up to 1.7.3). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which allows unauthenticated users to perform actions that should require higher privileges. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is considered low severity with a CVSS score of 5.3. It could allow unauthorized users to perform privileged actions, potentially leading to unauthorized file uploads or modifications. However, it is considered unlikely to be exploited and thus poses a low risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network/system detection methods provided for this vulnerability. The issue involves missing authorization checks in the WordPress File Uploads Addon for WooCommerce Plugin up to version 1.7.3, which could be detected by reviewing plugin version and configuration, but no explicit commands or detection tools are mentioned. [1]
What immediate steps should I take to mitigate this vulnerability?
As of the publication date, there is no official fix or patched version available for this vulnerability. Immediate mitigation steps include avoiding use of the affected plugin version (up to 1.7.3), restricting access to the plugin's upload functionality, and applying strict access control measures manually. Utilizing Patchstack's mitigation and security intelligence services may also help reduce risk. [1]