Arbitrary File Upload Vulnerability in Booster for WooCommerce Plugin by WordPress
CVE-2026-56027

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Booster For WooCommerce
Vendor
CVE Published:
26 June 2026

What is CVE-2026-56027?

The Booster for WooCommerce plugin versions up to 8.0.1 contain a vulnerability that allows attackers to upload arbitrary files. This can lead to various security issues, including remote code execution and unauthorized access to sensitive data. Website administrators using affected versions should prioritize updating their plugins to safeguard their sites against potential exploits.

Affected Version(s)

Booster for WooCommerce <= 8.0.1

References

https://patchstack.com/database/wordpress/plugin/woocomme...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Herman | Patchstack Bug Bounty Program
.