CVE-2026-16054: Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16054?
CVE-2026-16054 has a risk score of 54, indicating a medium severity vulnerability.
How do I fix CVE-2026-16054?
To fix CVE-2026-16054, update the Drag and Drop Multiple File Upload for WooCommerce plugin to version 1.1.8 or later.
What impact does CVE-2026-16054 have?
CVE-2026-16054 allows unauthenticated users to delete files from the upload directory, potentially leading to data loss.
Who is affected by CVE-2026-16054?
Any WordPress site using the Drag and Drop Multiple File Upload for WooCommerce plugin prior to version 1.1.8 is affected by CVE-2026-16054.
Is authentication required to exploit CVE-2026-16054?
No, CVE-2026-16054 can be exploited by unauthenticated users, making it particularly dangerous.