Vulnerability · Published Aug 6, 2026 · Assigned by WPScan

CVE-2026-16054Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle

Critical 9.1

In plain English

A critical-severity security flaw in Drag and Drop Multiple File Upload for WooCommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Drag and Drop Multiple File Upload for WooCommerce	0 – before 1.1.8

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

https://wpscan.com/vulnerability/3be51346-5d4c-4889-bc5c-f40749bd182a/ exploit, vdb-entry, technical-description