Vulnerability in WooCommerce Plugin Allows File Upload Exploits
CVE-2026-123122

Currently unrated

Key Information:

Vendor

WordPress
Status
Checkout Files Upload For WooCommerce
Vendor
CVE Published:
14 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-123122?

The Checkout Files Upload for WooCommerce plugin prior to version 2.4.1 lacks proper validation of uploaded files at the checkout process. This security gap enables unauthenticated users to upload malicious files, such as HTML files, disguising them as acceptable image formats. Consequently, these files can execute JavaScript code in the context of a shop manager or administrator who accesses an order screen, posing a significant security risk. This vulnerability re-emerged as a regression of a previous issue addressed in CVE-2025-4212.

Affected Version(s)

Checkout Files Upload for WooCommerce 2.4.0 < 2.4.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-123122 - Proof of Concept

References

https://wpscan.com/vulnerability/b9bd26b4-5334-4d40-9854-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Moshe Levi - Levinitycyber
WPScan
.