{"id":"CVE-2026-103688","kind":"vulnerability","aliases":["CVE-2026-103688"],"related":[],"title":"Checkout Files Upload for WooCommerce: unauthenticated file upload leads to code execution","description":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.","summary":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 skips file type checks when the accepted file types setting is left empty, which the plugin documents as accepting all files. An unauthenticated visitor can upload arbitrary files, including PHP files, and run them on servers that execute PHP from the uploads directory.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","woocommerce","wordpress"],"not_affected_if":["accepted-types-set","php-not-executed-in-uploads","plugin-2.4.0-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get checkout-files-upload-for-woocommerce --field=version` (plugin slug assumed; confirm in the sources).\n- Check the plugin's accepted file types setting in its WooCommerce settings; an empty value is the exposed state.\n- Look for unexpected `.php` files in the wp-content/uploads directory.","fix":"- Update the Checkout Files Upload for WooCommerce plugin to `2.4.0` or later.\n- Until updated, disable the plugin or set an explicit allowed file types list.\n- Remove any unknown PHP files found in the uploads directory.","status":"open","published_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:56+00:00","updated_at":"2026-10-28T06:32:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T06:32:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Checkout Files Upload for WooCommerce plugin to `2.4.0` or later.\n- Until updated, disable the plugin or set an explicit allowed file types list.\n- Remove any unknown PHP files found in the uploads directory.","reach":"internet","title":"Checkout Files Upload for WooCommerce: unauthenticated file upload leads to code execution","impact":"high","summary":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 skips file type checks when the accepted file types setting is left empty, which the plugin documents as accepting all files. An unauthenticated visitor can upload arbitrary files, including PHP files, and run them on servers that execute PHP from the uploads directory.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted","php"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker uploads PHP file and runs code on the server","analyst_note":"Confirm the exact plugin slug and whether any public exploit or exploitation activity exists; the sources only list NVD.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get checkout-files-upload-for-woocommerce --field=version` (plugin slug assumed; confirm in the sources).\n- Check the plugin's accepted file types setting in its WooCommerce settings; an empty value is the exposed state.\n- Look for unexpected `.php` files in the wp-content/uploads directory.","needs_analyst":true,"not_affected_if":["plugin-2.4.0-or-later","accepted-types-set","php-not-executed-in-uploads"],"who_is_affected":"Sites running the Checkout Files Upload for WooCommerce plugin before 2.4.0 on WordPress with WooCommerce checkout enabled and the accepted file types setting left empty. Exposure is greater where the web server executes PHP from the uploads directory, which is common on default WordPress setups. Sites on 2.4.0 or later, or with the plugin absent, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":3336,"output_tokens":761,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103688':15A,18A '-2026':14A,17A '2.4.0':35B,88C 'accept':42B,54B,97C,111C 'allow':114C 'arbitrari':62B,119C 'check':39B 'checkout':1A,27B,80C 'code':11A,128C 'cve':13A,16A 'directori':78B,138C 'document':52B,106C 'empti':48B,103C 'execut':12A,73B,129C,133C 'file':2A,7A,28B,37B,43B,56B,63B,66B,81C,93C,98C,113C,120C,123C 'host':23B 'includ':64B,121C 'lead':9A,125C 'left':47B,102C 'packag':19B 'php':20B,65B,74B,122C,134C 'plugin':33B,51B,86C 'remot':127C 'run':68B 'self':22B 'self-host':21B 'server':71B,131C 'set':45B,100C 'skip':36B 'type':38B,44B,94C,99C 'unauthent':6A,58B,115C 'upload':3A,8A,29B,61B,77B,82C,92C,118C,137C 'user':116C 'valid':91C 'visitor':59B 'way':109C 'woocommerc':5A,24B,31B,84C 'wordpress':25B,32B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Checkout Files Upload for WooCommerce plugin before 2.4.0 on WordPress with WooCommerce checkout enabled and the accepted file types setting left empty. Exposure is greater where the web server executes PHP from the uploads directory, which is common on default WordPress setups. Sites on 2.4.0 or later, or with the plugin absent, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103688","severity":null,"published_at":"2026-10-28T06:16:32+00:00","modified_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}