CVE-2026-103688
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.
| Vendor | unknown |
| Product | checkout files upload for woocommerce |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown checkout files upload for woocommerce
Be the first to know when new critical vulnerabilities affecting unknown checkout files upload for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Checkout Files Upload for WooCommerce
0 < 2.4.0
References
Credits
Josef Azizov (Spoofable) WPScan