Unauthenticated Token Forgery in PeproDev WooCommerce Receipt Uploader Plugin
CVE-2026-14314
Currently unrated
What is CVE-2026-14314?
The PeproDev WooCommerce Receipt Uploader plugin allows attackers to craft unauthorized access tokens that can be used to view image attachments uploaded by other users. This vulnerability occurs because the plugin does not properly validate the relationship between a requested attachment and the order specified by the token. As a result, unauthorized users can potentially access sensitive data such as payment receipts belonging to other customers, leading to privacy breaches and data exposure.
Affected Version(s)
PeproDev WooCommerce Receipt Uploader 0 <= 2.8.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.