CVE-2026-107594: File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
File Upload to Orderto a version that resolves this vulnerability.Fixed in 1.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can reach the deletion action. No login is required, and the vulnerable path is derived from attacker-controlled session data.
Which installations are affected?
File Upload to Order versions before 1.1.4 are affected. The provided information does not identify any configuration requirement or mitigation through disabling a particular feature.
What can an attacker delete?
An attacker can cause deletion of arbitrary files on the server because the plugin does not validate or confine the supplied file path. Deleting certain files may lead to full site compromise.