CVE-2026-13607 — File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it…
Published: 2026-10-05 · CVSS: 5.9 · CVSS 3.1
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7