CVE-2026-14313 in WooCommerce Receipt Uploader Plugin
Summary
by MITRE • 08/06/2026
PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0 (latest on wordpress.org; no fixed version available at the time of writing), is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The PeproDev WooCommerce Receipt Uploader plugin for WordPress presents a critical authorization flaw that allows unauthenticated attackers to manipulate receipt upload functionality through a missing authorization check vulnerability. This issue affects all versions up to and including 2.8.0, with no fixed version currently available in the official WordPress repository. The vulnerability specifically manifests as an IDOR (Insecure Direct Object Reference) in the plugin's handling of receipt uploads, where the system fails to properly validate user permissions before processing file upload operations.
The technical implementation flaw occurs within the plugin's backend processing logic where it does not perform adequate authorization checks before allowing receipt uploads to be associated with specific WooCommerce orders. This missing authorization mechanism enables any unauthenticated user to submit receipt files that could potentially be linked to legitimate customer orders, creating a pathway for unauthorized data manipulation and potential financial fraud. The vulnerability requires the presence of WooCommerce to exist, as the plugin's functionality is tightly integrated with WooCommerce order management systems and payment processing workflows.
Operational impact of this vulnerability extends beyond simple data manipulation to encompass potential financial fraud scenarios where attackers could upload false receipt files to orders they do not own, disrupting legitimate business processes and potentially causing revenue loss. The unauthenticated nature of the exploit means that malicious actors can leverage this vulnerability without requiring any valid credentials or user accounts, making it particularly dangerous in environments where the plugin is widely deployed. Attackers could systematically target multiple orders within a store's database, potentially affecting numerous customer transactions and undermining trust in the payment processing system.
The vulnerability aligns with CWE-639 (Authorization Bypass Through User-Controlled Key) and represents a clear violation of the principle of least privilege in web application security. From an ATT&CK framework perspective, this issue maps to T1078 (Valid Accounts) and T1566 (Phishing) as it enables attackers to exploit legitimate system functionality through unauthorized access patterns. Organizations using this plugin should immediately implement mitigations including disabling the plugin until a patched version is available, implementing network-level restrictions on the affected endpoints, and conducting comprehensive audits of existing receipt data to identify any potential unauthorized modifications. Additionally, administrators should consider implementing additional monitoring controls around order receipt upload activities and review their WordPress security configurations to prevent similar authorization bypass vulnerabilities from occurring in other plugins or custom code implementations.
The lack of available patch updates for this vulnerability creates significant operational challenges for affected organizations, as they must balance immediate security concerns with business continuity requirements. This situation highlights the importance of maintaining up-to-date security monitoring practices and having contingency plans for dealing with vulnerable software components that lack active maintenance or patching support from their vendors.