CVE-2026-107594

File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

Affected

File Upload to Order

CVSS v3.1 CNA

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

EPSS

0.46% chance of exploitation in the next 30 days, 38th percentile

Published

2026-10-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/

References

• CVE Record
• NVD entry