CVE-2026-107594: fallo crítico en File Upload to Order
File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
48Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 10epss 0.5%
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Productos afectados
Unknown · File Upload to OrderPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.