VulnSocial

CVE-2026-107594

LOWCVSS 10.0 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-73

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-10-15: 310-15
Referenced assets1 URL
By indicator
Full discourse3 posts
  • ExploitGrid@exploitgrid

    ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-107594 (CVSS: 10) Unknown CVE-2026-110536 (CVSS: 10) dlink CVE-2026-55572 (CVSS: 10) e107inc CVE-2026-108390 (CVSS: 9.9) hestiacp CVE-2026-77524 (CVSS: 9.9) kedacore ..🧵👇

    1000183
    404 followersView on X
  • ExploitGrid@exploitgrid

    🟠 HIGH PRIORITY (CVSS 9.9-10) ├ CVE-2026-107594 · File Upload to Order < 1.1.4 · Unauth arbitrary file deletion (10) ├ CVE-2026-110536 · D-Link DIR-868L · OS command injection via HNAP CGI (10) ├ CVE-2026-55572 · e107 · SQL injection in alt_auth plugin (10)

    1000034
    404 followersView on X
  • ExploitGrid@exploitgrid

    [CVE] CVE-2026-107594 [HIGH PRIORITY] CVSS: 10 | Vendor: #Unknown #File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion 🔗 https://exploitgrid.net/cve/CVE-2026-107594

    1000050
    404 followersView on X

Explore more

Back to dashboard