Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVSS 10 in a WooCommerce plugin. Checkout Files Upload below 2.4.0 lets anyone upload files to your store with no login. Patchstack published it on 28 October, fix is 2.4.0. Not exploited yet, and mass-exploit scanners move fast. Link: https://www.mitss.co.za/blog/our-blog-1/woocommerce-checkout-upload-cve-2026-103688-245 #CyberSecurity #WordPress #WooCommerce