CVE-2026-16054
Received Received - Intake

Unauthenticated File Deletion in WooCommerce Drag and Drop Upload Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-16054
EUVD
EUVD-2026-53722

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WordPress plugin 'Drag and Drop Multiple File Upload for WooCommerce' before version 1.1.8. It allows unauthenticated attackers to delete files in the plugin's upload directory by obtaining a valid nonce, which is the only control for the file-deletion routine. This can permanently destroy customers' pending order attachments.

Detection Guidance

Check if the WordPress plugin 'Drag and Drop Multiple File Upload for WooCommerce' is installed and verify its version. If the version is below 1.1.8, the system is vulnerable. Inspect the plugin's upload directory for unauthorized file deletions or unusual activity.

Impact Analysis

If you use the affected plugin, attackers could delete files in the upload directory, causing permanent loss of customers' pending order attachments. This could disrupt order processing and lead to data loss for pending transactions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized deletion or loss of sensitive customer data stored in pending order attachments. Data integrity and availability requirements may be violated.

Mitigation Strategies

Update the plugin to version 1.1.8 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review the upload directory for any deleted files and restore from backups if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart