CVE-2026-6802

MediumCVSS 5.3

Published: 10/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

The Easy Upload Files During Checkout plugin for WordPress versions up to 3.0.1 is vulnerable to unauthorized access. The ufdc_custom_init() function processes the 'eufdc-delete' parameter without nonce verification, capability check, or attachment ownership validation, allowing unauthenticated attackers to permanently delete arbitrary media library attachments.

Risk Assessment

The organization risks permanent deletion of media files, which can disrupt website functionality, remove critical assets, and compromise content integrity.

Recommendation

Immediately update the Easy Upload Files During Checkout plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.

Other vulnerabilities in Easy Upload Files During Checkout

CVE-2025-62078Medium
The Easy Upload Files During Checkout plugin up to version 3.0.0 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

Original NVD description (English source)

The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1. This is due to missing authorization checks in the ufdc_custom_init() function, which processes the 'eufdc-delete' parameter without any nonce verification, capability check, or attachment ownership validation. This makes it possible for unauthenticated attackers to permanently delete arbitrary media library attachments from the WordPress site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS