Vulnerability · Published Oct 14, 2026 · Assigned by WPScan

CVE-2026-107594File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion

Critical 10.0

In plain English

A critical-severity security flaw in File Upload to Order from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

Affected products (as reported)

Vendor	Product	Versions
Unknown	File Upload to Order	0 – before 1.1.4

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

References

https://wpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/ exploit, vdb-entry, technical-description