CVE-2026-77693: Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Order Tip for WooCommerceto a version that resolves this vulnerability.Fixed in 1.6.0 - Configuration
Ensure the delete_exported_csv_file_ajax handler checks the capability of the requesting user and restricts deletion to allowed paths to prevent arbitrary file deletion (WordPress plugin versions before 1.6.0 lack these checks).
WordPress capability checks for delete_exported_csv_file_ajax (Order Tip for WooCommerce) = enabled - Compensating control
As a mitigating control until patched, restrict access/control of Shop Manager+ capabilities that can trigger file deletion, since the issue affects users with the Shop Manager role and above.
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user with the Shop Manager role or a higher-privileged role can exploit it. The vulnerable request does not verify that the requester has the capability needed to delete files.
What access does an attacker need?
The attacker needs an authenticated WordPress account assigned the Shop Manager role or above. The issue is exposed through the delete_exported_csv_file_ajax functionality.
What is the practical impact?
An eligible attacker can delete arbitrary files on the server because the plugin does not restrict the file path that may be deleted. This could potentially lead to takeover of the site.
Which plugin versions are affected?
Order Tip for WooCommerce versions before 1.6.0 are affected. Updating to version 1.6.0 or later addresses the stated affected-version range.