CVE-2026-77693
Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
CVSS Score
8.7
EPSS Score
0.2%
EPSS Percentile
6th
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over.
| Vendor | unknown |
| Product | order tip for woocommerce |
| Published | Aug 26, 2026 |
| Last Updated | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown order tip for woocommerce
Be the first to know when new high vulnerabilities affecting unknown order tip for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Order Tip for WooCommerce
0 < 1.6.0
References
Credits
Shikhali Jamalzade WPScan