Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Checkout Files Upload for WooCommerce lets anyone upload files

CVE-2026-103688 · published 7 days ago
Summary

The Checkout Files Upload plugin for WooCommerce (versions before 2.4.0) does not check what type of file is being uploaded when its file‑type setting is left blank. This permits anyone on the internet to place any file—including dangerous code files—onto the website’s server. Update the plugin to version 2.4.0 or later, or restrict the accepted file types, to stop unauthorized uploads.

What to do
  • Update unknown checkout files upload for woocommerce to version 2.4.0 or later.
Affected software
VendorProductAffected versions
unknown checkout files upload for woocommerce < 2.4.0
Original advisory text
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published28 Oct 2026
Updated4 Nov 2026
First seen28 Oct 2026
Sources
CVE-2026-103688 · NVD
CVE-2026-103688 · MITRE
Track software like this
Free during beta