CVE-2026-13607 in File Uploads Addon for WooCommerce Plugin
Summary
by MITRE • 10/05/2026
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in the File Uploads Addon for WooCommerce WordPress plugin versions prior to 1.7.6 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control and CWE-538 Insertion of Sensitive Information into Log File or Other External Entity if logs are involved, though primarily it is an information disclosure issue stemming from misconfigured file storage permissions. The core technical flaw lies in the plugin's architectural decision to store customer-uploaded files within a publicly web-accessible directory on the server filesystem without implementing robust server-level access restrictions. While the application logic attempts to enforce authentication by requiring users to be logged into WooCommerce to download these files through specific endpoints, this protection is entirely dependent on the PHP script execution and does not extend to direct file retrieval via HTTP requests that bypass the plugin's entry points.
From a technical perspective, the vulnerability exploits the default behavior of web servers such as Apache or Nginx, which serve static content from public directories without requiring authentication unless explicitly configured otherwise. Because the uploaded files are placed in this accessible path with standard read permissions for the web server process, an attacker who can predict or guess the filename associated with a specific upload can construct a direct URL to that file. This bypasses the plugin's intended authenticated download mechanism entirely, as the request is served directly by the web server rather than being processed through the WordPress authentication hooks and WooCommerce permission checks designed to restrict access to authorized users only.
The operational impact of this vulnerability is severe, particularly given the nature of data typically uploaded via e-commerce platforms using such plugins. Customers often upload sensitive personal documents including identification cards, proof of address, medical records, or proprietary business information during checkout processes for custom products or services. An unauthenticated attacker who discovers these file names can retrieve this confidential data without any credentials, leading to a significant breach of customer privacy and potential violation of data protection regulations such as GDPR or CCPA. This exposure undermines the trust between the e-commerce store and its customers and exposes the organization to legal liabilities and reputational damage resulting from unauthorized access to personally identifiable information.
In terms of threat modeling, this vulnerability aligns with ATT&CK technique T1078 Valid Accounts if the attacker were to use stolen credentials, but more accurately reflects T1530 Data from Cloud Storage Object or T1005 Data from Local System depending on the infrastructure setup, as it involves direct retrieval of data stored in a location intended for public access. The attack vector is straightforward and does not require complex exploitation chains; it relies solely on file name enumeration or prediction, which can be automated using common naming conventions used by WordPress plugins such as sequential IDs or hashed filenames that may have predictable patterns if the randomization algorithm is weak.
To mitigate this vulnerability, immediate action must be taken to upgrade the File Uploads Addon for WooCommerce plugin to version 1.7.6 or later where these access control issues are addressed. In addition to updating the software, administrators should implement server-level security measures such as configuring .htaccess files in Apache or location blocks in Nginx to deny direct web access to directories containing sensitive uploads while allowing PHP scripts within those directories to read them. This ensures that even if file names are known, they cannot be retrieved via a simple HTTP GET request. Furthermore, storing uploaded files outside the public document root is a best practice that eliminates this class of vulnerability entirely by ensuring no direct URL mapping exists for these resources. Regular security audits and penetration testing should also be conducted to verify that access controls are functioning as intended across all file upload functionalities within the WordPress environment.