CVE-2026-77693

The Order Tip for WooCommerce WordPress plugin (versions before 1.6.0 ) contains an arbitrary file deletion vulnerability in the delete_exported_csv_file_ajax function. The plugin fails to verify the requesting user's capability or restrict the file path, allowing authenticated users with the Sho...