CVE-2026-107594
Unauthenticated arbitrary file deletion in File Upload to Order
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
The File Upload to Order WordPress plugin before 1.1.4 takes a file path from attacker-controlled session data and deletes that path without validating or confining it. The deletion action is reachable without authentication, so a remote attacker can delete arbitrary files on the server. Removing certain files can lead to full compromise of the WordPress site. Every site running a vulnerable version of this plugin is affected. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Update the File Upload to Order plugin to version 1.1.4 or later on every WordPress site that uses it. Until that is done, disable or remove the plugin. After patching, review the web server and WordPress files for unexpected deletions and restore anything missing from a known-good backup.
| Product | Affected |
|---|---|
| File Upload to Order | before 1.1.4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
- Ecosystems
- WordPress
- Weakness
- CWE-73
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.