---
id: "CVE-2026-103688"
kind: "vulnerability"
aliases: ["CVE-2026-103688"]
title: "Checkout Files Upload for WooCommerce: unauthenticated file upload leads to code execution"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["accepted-types-set", "php-not-executed-in-uploads", "plugin-2.4.0-or-later"]
published_at: "2026-10-28T06:16:32+00:00"
first_seen_at: "2026-10-28T06:31:26+00:00"
updated_at: "2026-10-28T06:32:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103688", "first_seen_at": "2026-10-28T06:31:26+00:00"}]
---

# Checkout Files Upload for WooCommerce: unauthenticated file upload leads to code execution

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 skips file type checks when the accepted file types setting is left empty, which the plugin documents as accepting all files. An unauthenticated visitor can upload arbitrary files, including PHP files, and run them on servers that execute PHP from the uploads directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get checkout-files-upload-for-woocommerce --field=version` (plugin slug assumed; confirm in the sources).
- Check the plugin's accepted file types setting in its WooCommerce settings; an empty value is the exposed state.
- Look for unexpected `.php` files in the wp-content/uploads directory.

## Fix

- Update the Checkout Files Upload for WooCommerce plugin to `2.4.0` or later.
- Until updated, disable the plugin or set an explicit allowed file types list.
- Remove any unknown PHP files found in the uploads directory.

## Timeline

- 2026-10-28T06:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103688

## From the sources

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_