File Upload Vulnerability in WordPress Plugin by Order
CVE-2026-107594
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-107594?
The File Upload to Order plugin for WordPress allows unauthenticated users to exploit a flaw in file path handling, enabling them to delete arbitrary files on the server. This security issue arises because the plugin does not properly validate file paths derived from attacker-controlled session data. Consequently, this oversight can lead to critical ramifications, including the potential for complete site compromise due to the deletion of critical files.
Affected Version(s)
File Upload to Order 0 < 1.1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.