CVE-2026-78371

MediumCVSS 5.9

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

Risk Assessment

An attacker can access confidential files of other customers, potentially leading to leakage of personal or sensitive information.

Recommendation

Update the File Uploads Addon for WooCommerce plugin to version 1.7.6 or later that includes security fixes. Additionally, implement file access authorization mechanisms.

Other vulnerabilities in File Uploads Addon for WooCommerce

CVE-2026-13607Medium
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the plugin's authenticated download mechanism.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS