WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR vulnerability

Unauthenticated Order Receipt Tampering via IDOR vulnerability discovered by Lyris Vale in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.8.0...

CVE-2026-14313

The PeproDev WooCommerce Receipt Uploader WordPress plugin (slug: pepro-bacs-receipt-upload-for-woocommerce) is vulnerable to an unauthenticated missing-authorization / IDOR write vulnerability in all versions up to and including 2.8.0 . This flaw allows for unauthenticated order receipt tamperin...

PT-2026-68392

Name of the Vulnerable Software and Affected Versions PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1 Description The plugin is vulnerable to an unauthenticated Insecure Direct Object Reference IDOR write, which occurs when an application provides direct access to objects based on...