CVE-2026-16054

9.1 Critique

Publiée le 06/08/2026 à 09:16 · Modifiée le 26/08/2026 à 18:31 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

Traduire en français

Produits concernés

Unknown Drag and Drop Multiple File Upload for WooCommerce

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-73

Références

https://wpscan.com/vulnerability/3be51346-5d4c-4889-bc5c-f40749bd182a/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories