Veille CVE

Recherche « Unknown Order Tip for WooCommerce »

3 CVE

Critique 1 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Order Tip for WooCommerce » ✕
  1. CVE-2026-77693 8.7 Élevée

    Unknown Order Tip for WooCommerce

    The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over.

  2. CVE-2026-18357 7.5 Élevée

    Unknown WPC Order Tip for WooCommerce

    The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.

  3. CVE-2026-16054 9.1 Critique

    Unknown Drag and Drop Multiple File Upload for WooCommerce

    The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.