Vulnerability in Order Tip For Woocommerce

CVE-2026-77693

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.005 (37.4th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-77693: held from 0.003 to 0.005.

EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.001

Affected products

  • Order Tip For Woocommerce

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-77693?
CVE-2026-77693 is a high-severity vulnerability in Order Tip For Woocommerce, classified under External Control of File Name or Path. CVSS score: 8.7/10. Published 2026-08-26.
How severe is CVE-2026-77693?
High severity. CVSS v3 base score is 8.7 out of 10.