CVE-2026-14313
Received Received - Intake

Unauthenticated IDOR Write in PeproDev WooCommerce Receipt Uploader

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0 (latest on wordpress.org; no fixed version available at the time of writing), is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-14313
EUVD
EUVD-2026-53718

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
peprodev woocommerce_receipt_uploader to 2.8.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the PeproDev WooCommerce Receipt Uploader plugin. It allows unauthenticated users to upload files to any WooCommerce order without proper authorization checks. The plugin exposes an AJAX action that accepts requests from non-authenticated users and lacks verification of order ownership or user authentication.

Detection Guidance

Check if the PeproDev WooCommerce Receipt Uploader plugin version 2.8.0 or earlier is installed. Look for unauthorized file uploads in WooCommerce orders via the exposed AJAX action wp_ajax_nopriv_upload-payment-receipt. Review server logs for suspicious AJAX requests to this endpoint.

Impact Analysis

Attackers can upload arbitrary files to any order, modify receipt-related metadata, and potentially change order statuses if approval-status mapping is enabled. This could disrupt fulfillment and accounting processes, leading to financial or operational disruptions.

Compliance Impact

This vulnerability could lead to unauthorized modifications of order data, potentially violating integrity and confidentiality requirements under GDPR and HIPAA. Unauthorized file uploads may expose sensitive information or alter records, creating compliance risks.

Mitigation Strategies

Disable the PeproDev WooCommerce Receipt Uploader plugin immediately. If WooCommerce is required, implement server-side authorization checks for the wp_ajax_nopriv_upload-payment-receipt action. Verify no unauthorized receipts were uploaded to orders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14313. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart