File Deletion Vulnerability in Drag and Drop Multiple File Upload for WooCommerce by WordPress
CVE-2026-16054
What is CVE-2026-16054?
The Drag and Drop Multiple File Upload for WooCommerce plugin prior to version 1.1.8 exhibits a critical security flaw that permits unauthenticated users to exploit a valid nonce, which serves as the sole barrier to executing file deletion operations. This vulnerability allows malicious actors to delete files in the upload directory, potentially resulting in the irreversible loss of customer order attachments. This issue highlights the importance of robust user authentication and nonce validation to secure file management functionalities.
Affected Version(s)
Drag and Drop Multiple File Upload for WooCommerce 0 < 1.1.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.