CVE-2026-107594
10.0CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-73
Impact
Unauthenticated remote attackers can delete arbitrary files on the server, potentially causing site takeover or denial of service. They only need network access to the target WordPress instance.
Root cause
The plugin exposes a file deletion action to unauthenticated users that unsafely trusts and deletes a file path supplied directly from session data without validation.
Affected systems
File Upload to Order WordPress plugin before 1.1.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Fix & remediation
Upgrade the File Upload to Order plugin to version 1.1.4 or later. If updating immediately is not possible, deactivate and uninstall the plugin.
$ wp plugin update file-upload-to-orderAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.