CVE-2026-16054
Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.
| Vendor | unknown |
| Product | drag and drop multiple file upload for woocommerce |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown drag and drop multiple file upload for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown drag and drop multiple file upload for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Drag and Drop Multiple File Upload for WooCommerce
0 < 1.1.8
References
Credits
WPScan