Arbitrary File Upload Vulnerability in Extra Checkout Options Plugin for WordPress

CVE-2026-14270

What is CVE-2026-14270?

The Extra Checkout Options plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate authorization checks in the eco_save_settings() function. This flaw permits authenticated users with low privileges, specifically those with Subscriber-level access and above, to manipulate the upload allowlist settings. This oversight, combined with the insufficient authorization in the wc_eco_upload_file AJAX action, can result in the potential upload of PHP files, enabling exploitation methods such as remote code execution. While version 2.3.2 has partially addressed this issue, it is crucial for users to remain vigilant and ensure their plugins are regularly updated to mitigate risks.

References