CVE-2026-13607
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the plugin's authenticated download mechanism.
Risk Assessment
An attacker can access confidential customer files without authorization, potentially leading to leakage of personal or sensitive information.
Recommendation
Update the File Uploads Addon for WooCommerce plugin to the latest version that includes security fixes. Additionally, move the uploads directory outside public access or implement effective access control mechanisms.
Other vulnerabilities in File Uploads Addon for WooCommerce
Original NVD description (English source)
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS