19 matches found
WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.6 - Unauthenticated Direct File Access vulnerability
Unauthenticated Direct File Access vulnerability discovered by J4ck13Ch4n in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.6...
WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.5 - Unauthenticated Customer Uploaded File Disclosure vulnerability
Unauthenticated Customer Uploaded File Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.5...
CVE-2026-13607
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
CVE-2026-78371
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...
CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
CVE-2026-13607
The File Uploads Addon for WooCommerce WordPress plugin, in versions through 1.7.6 , is vulnerable to unauthenticated direct file access. The root cause is that customer-uploaded files are stored in a publicly web-accessible uploads directory where the plugin's intended access restrictions are in...
CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
EUVD-2026-92261
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
EUVD-2026-92262
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...
CVE-2026-78371
The File Uploads Addon for WooCommerce WordPress plugin versions before 1.7.6 contains a vulnerability where it fails to verify the identity of users requesting customer-uploaded files. This lack of authorization allows unauthenticated attackers to download files belonging to other customers if t...
CVE-2026-78371 File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...
CVE-2026-78371 File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...
CVE-2026-78371: Authorization Bypass Through User-Controlled Key
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...
CVE-2026-13607: Improper Access Control
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
PT-2026-104730
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...
PT-2026-104729
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...
CVE-2026-24625: Missing Authorization
Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through = 1.7.3...
PT-2025-6584
Name of the Vulnerable Software and Affected Versions File Uploads Addon for WooCommerce versions up to, and including, 1.7.1 Description The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory, which can contain file attachments...
CVE-2024-13622: Exposure of Sensitive Information to an Unauthorized Actor
The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the...