Arbitrary File Upload Vulnerability in WooCommerce Checkout Files Upload Plugin
CVE-2026-103688

Currently unrated

Key Information:

Vendor

WordPress
Status
Checkout Files Upload For WooCommerce
Vendor
CVE Published:
28 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-103688?

The Checkout Files Upload plugin for WooCommerce prior to version 2.4.0 allows unvalidated file uploads when the accepted file types setting is left empty. This misconfiguration permits unauthenticated users to upload any file type, including potentially malicious PHP scripts. Once uploaded, these files can be executed on servers that permit PHP execution from the uploads directory, posing significant security risks and enabling remote code execution vulnerabilities.

Affected Version(s)

Checkout Files Upload for WooCommerce 0 < 2.4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-103688 - Proof of Concept

References

https://wpscan.com/vulnerability/08777aa1-6308-4e99-b2d0-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Josef Azizov (Spoofable)
WPScan
.