CVE-2026-107594
10 CRITICALPublished 2026-10-14 · Updated 2026-10-14
AI risk analysis
- Summary
- The WordPress plugin allows unauthenticated users to delete arbitrary files on the server by manipulating session data that controls file paths. This can lead to complete site compromise when critical files are removed.
- Exploitability
- Exploitation is straightforward requiring no authentication and only needs a way to set session data, with the main precondition being that the vulnerable plugin is installed and active.
- Blast radius
- The impact could be severe as attackers can delete core WordPress files, plugins, or configuration files, potentially leading to complete site takeover or data loss.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 1.1.4 or later to fix the file path validation vulnerability.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Weaknesses
CWE-73
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-89301PoC
- CRITICALCVE-2026-90817
- CRITICALCVE-2017-20241
- CRITICALCVE-2023-54399
- CRITICALCVE-2023-54405PoC
- HIGHCVE-2025-1281
- CRITICALCVE-2025-70518
- CRITICALCVE-2025-70521
Related by shared AI tags and CWE weakness class. Browse the full archive.