Vulnerability in File Upload To Order
CVE-2026-107594
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- File Upload To Order
Weakness classification (CWE)
References
- wpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/ (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-107594?
- CVE-2026-107594 is a critical-severity vulnerability in File Upload To Order, classified under External Control of File Name or Path. CVSS score: 10.0/10. Published 2026-10-14.
- How severe is CVE-2026-107594?
- Critical severity. CVSS v3 base score is 10.0 out of 10.