CVE-2026-28171: WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Q: Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or other prior privileges to exploit it.

Q: What is the likely impact of successful exploitation?

Successful exploitation can allow arbitrary file deletion. The recorded severity vector indicates a high availability impact, while confidentiality and integrity impacts are not identified.

Q: Which plugin versions are affected?

WooCommerce File Approval versions 10.7 and earlier are identified as affected.

Published Aug 24, 2026

Updated

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.

Affected Software

1 affected component

WooCommerce File Approval<=10.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WooCommerce File Approval plugin to a version that resolves this vulnerability.
Fixed in 10.7

Event History

Aug 24, 2026

CVE Published

via MITRE·11:54 AM

Data Sourced

via MITRE·11:54 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or other prior privileges to exploit it.

What is the likely impact of successful exploitation?

Successful exploitation can allow arbitrary file deletion. The recorded severity vector indicates a high availability impact, while confidentiality and integrity impacts are not identified.

Which plugin versions are affected?

WooCommerce File Approval versions 10.7 and earlier are identified as affected.

CVE-2026-28171: WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of successful exploitation?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of successful exploitation?

Which plugin versions are affected?