Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

File Upload to Order plugin lets anyone delete server files

CVE-2026-107594 · published 2 days ago
Summary

The File Upload to Order WordPress plugin, versions before 1.1.4, allows a public user to delete files on the web server. This could let an attacker remove important files and take control of your site. Update the plugin to version 1.1.4 or later, or remove it if you do not need it, and review your site for any missing or altered files.

What to do
  • Update unknown file upload to order to version 1.1.4 or later.
Affected software
VendorProductAffected versions
unknown file upload to order < 1.1.4
Original advisory text
File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
References
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-73External Control of File Name or Path
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-107594 · NVD
CVE-2026-107594 · MITRE
Track software like this
Free during beta