CVE-2026-13607
Received Received - Intake

Unauthenticated File Access in WooCommerce File Uploads Addon

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: WPScan

Description
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-13607
EUVD
EUVD-2026-92261

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce file_uploads_addon to 1.7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the File Uploads Addon for WooCommerce WordPress plugin versions up to 1.7.6. It allows unauthenticated attackers to directly access customer-uploaded files stored in a public directory by guessing or knowing the file name. The plugin's intended access restrictions fail to prevent this unauthorized access.

Detection Guidance

Check if customer-uploaded files are stored in a publicly accessible directory by attempting to access files directly via URL. Look for directories like /wp-content/uploads/ or similar paths where files might be stored. Verify if the plugin's access restrictions are bypassed by testing unauthenticated file retrieval.

Impact Analysis

An attacker could retrieve sensitive customer-uploaded files without authentication. This may lead to exposure of private data, financial documents, or other confidential information stored in those files. The impact includes potential data breaches and loss of customer trust.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other privacy regulations due to unauthorized access to personal or sensitive data. Organizations may face legal penalties, fines, and reputational damage if customer data is exposed through this flaw.

Mitigation Strategies

Update the File Uploads Addon for WooCommerce plugin to the latest version if available. Restrict direct access to the uploads directory by configuring server rules to block unauthorized access. Implement proper authentication checks for file downloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart