Live › vulnerability › CVE-2026-103688
Go to dashboardThe Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 skips file type checks when the accepted file types setting is left empty, which the plugin documents as accepting all files. An unauthenticated visitor can upload arbitrary files, including PHP files, and run them on servers that execute PHP from the uploads directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Checkout Files Upload for WooCommerce plugin before 2.4.0 on WordPress with WooCommerce checkout enabled and the accepted file types setting left empty. Exposure is greater where the web server executes PHP from the uploads directory, which is common on default WordPress setups. Sites on 2.4.0 or later, or with the plugin absent, can skip this.
No product ranges from the sources yet.
wp plugin get checkout-files-upload-for-woocommerce --field=version (plugin slug assumed; confirm in the sources)..php files in the wp-content/uploads directory.2.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-103688")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.