Unauthorized Access in Easy Upload Files During Checkout Plugin for WordPress

CVE-2026-6802

What is CVE-2026-6802?

The Easy Upload Files During Checkout plugin for WordPress is susceptible to unauthorized access vulnerabilities due to inadequate authorization checks in its core function. Specifically, the 'ufdc_custom_init()' function processes the 'eufdc-delete' parameter without implementing necessary nonce verification or capability checks, allowing an unauthenticated attacker to delete any media library attachments. This could lead to significant data loss for website owners, as attackers can manipulate the media content without any restrictions.

References