Vulnerability · Published Oct 11, 2026 · Assigned by WPScan

CVE-2026-93550Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process

Medium 4.3

In plain English

A medium-severity unrestricted file upload in Veeqo for WooCommerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Veeqo for WooCommerce	0 – through 2.2.8

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/09517757-2f99-42d5-8300-e1f618373059/ exploit, vdb-entry, technical-description