CVE-2026-107594 in File Upload to Order Plugin
Summary
by MITRE • 10/14/2026
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in File Upload to Order WordPress plugin versions prior to 1.1.4 represents a critical security flaw rooted in improper input validation and insufficient access control mechanisms. The core technical issue lies within the file deletion functionality, which fails to properly sanitize or validate file paths derived from attacker-controlled session data before executing removal operations on the server filesystem. This lack of path canonicalization allows for directory traversal attacks where an adversary can manipulate relative path components such as dot-dot-slash sequences to escape the intended target directory and specify arbitrary locations within the web root or system hierarchy. By bypassing these essential validation checks, the application permits the deletion of files that are critical to the integrity and availability of the WordPress installation itself.
From a technical perspective, this flaw constitutes an Unrestricted File Upload variant specifically manifesting as Arbitrary File Deletion due to insufficient path normalization. The vulnerability is exacerbated by the fact that the action triggering the file deletion does not enforce any form of authentication or authorization checks. This means that unauthenticated users interacting with the public-facing interface can directly invoke the vulnerable endpoint without providing valid credentials. In standard web application security models, destructive actions such as deleting server-side files should be strictly gated behind robust session validation and role-based access controls to prevent unauthorized modifications to system state. The absence of these safeguards transforms a simple file management feature into a powerful vector for remote exploitation.
The operational impact of this vulnerability is severe, potentially leading to complete compromise of the affected WordPress site. An attacker can leverage this flaw to delete essential configuration files such as wp-config.php, which contains database credentials and security salts, thereby disrupting application functionality or exposing sensitive data if backup mechanisms are not in place. Furthermore, by deleting core plugin files or theme assets, an attacker can cause a denial of service condition that renders the website inaccessible to legitimate users. More insidiously, this vulnerability facilitates further exploitation stages; for instance, removing security plugins or firewall rules may expose other latent vulnerabilities within the CMS environment. In some scenarios, if combined with other misconfigurations such as writable directories, an attacker might delete existing files and subsequently upload malicious scripts, achieving remote code execution through a file inclusion vector that relies on the absence of original defensive checks.
This vulnerability aligns closely with Common Weakness Enumeration identifiers including CWE-22 for Improper Limitation of a Pathname to a Restricted Directory and CWE-732 for Incorrect Permission Assignment for Critical Resource. Additionally, from an offensive security framework perspective, it maps to MITRE ATT&CK techniques related to Defense Evasion via file deletion or modification, allowing attackers to remove evidence or disable security controls. It also touches upon Broken Access Control principles where the application fails to restrict actions based on user privileges. The combination of unauthenticated access and unchecked path manipulation creates a high-severity risk that demands immediate remediation.
To mitigate this vulnerability, administrators must upgrade the File Upload to Order plugin to version 1.1.4 or later, which addresses these input validation deficiencies. In cases where upgrading is not immediately feasible, implementing server-side web application firewall rules can help block requests containing directory traversal patterns in session parameters associated with file deletion endpoints. Additionally, enforcing strict authentication requirements on all administrative and operational actions within the plugin would significantly reduce the attack surface by ensuring that only authorized users can trigger sensitive operations like file removal. Regular auditing of third-party plugins for adherence to secure coding standards is also recommended to prevent similar issues arising from unvalidated user input in future updates or other extensions.