CVE-2026-93550: Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can trigger the vulnerable bridge-installation process. This includes low-privilege accounts, not only administrators.
What does an attacker need to provide?
The attacker needs an account with at least the Subscriber role and a URL to an attacker-controlled archive. The plugin downloads and extracts that archive without validating the supplied URL.
What is the likely impact after successful exploitation?
An attacker can cause arbitrary PHP files from the supplied archive to be extracted into the WordPress root. This can enable execution of attacker-controlled PHP code on the affected site.
How can I determine whether my site is affected?
Sites using Veeqo for WooCommerce version 2.2.8 or earlier are affected according to the available information. Review the WordPress root for unexpected PHP files and investigate plugin-related bridge installation activity or downloads from untrusted URLs.