CVE-2026-107594: WordPress File Upload Path Traversal

CVE-2026-107594 Overview

CVE-2026-107594 affects the File Upload to Order WordPress plugin in versions prior to 1.1.4. The plugin does not validate or constrain a file path derived from attacker-controlled session data before deleting the targeted file. The deletion action is reachable without authentication, which allows unauthenticated attackers to remove arbitrary files from the WordPress server.

Deleting specific files, such as wp-config.php, can trigger WordPress reinstallation flows and lead to full site takeover. The weakness maps to CWE-73: External Control of File Name or Path.

Critical Impact
Unauthenticated attackers can delete arbitrary files on the server, enabling full site compromise through forced reinstallation of WordPress.

Affected Products

File Upload to Order WordPress plugin, all versions before 1.1.4
WordPress sites running the plugin with public access to plugin endpoints
Any hosting environment where the WordPress process user has write access to core files

Discovery Timeline

2026-10-14 - CVE-2026-107594 published to the National Vulnerability Database
2026-10-14 - Last updated in the NVD database
Reference published by WPScan Vulnerability Advisory

Technical Details for CVE-2026-107594

Vulnerability Analysis

The File Upload to Order plugin exposes an action handler responsible for removing uploaded files associated with an order. That handler reads a file path from PHP session data and passes it to a file deletion function without validating that the path remains inside an expected upload directory.

Session data in this plugin flow can be influenced by an unauthenticated client. An attacker can place a traversal path or absolute path into the session, then invoke the deletion endpoint. The server deletes whatever file the path resolves to, including WordPress core files.

Removing wp-config.php is the most direct route to compromise. WordPress treats a missing configuration file as a fresh installation and serves the setup wizard. An attacker can then supply attacker-controlled database credentials and seize administrative control of the site.

Root Cause

The root cause is improper neutralization of a file path pulled from external control, matching [CWE-73]. The plugin trusts session-stored values as safe and omits both path canonicalization and a directory allowlist check before calling the delete routine.

Attack Vector

Exploitation occurs over the network against the WordPress site. The attacker requires no credentials and no user interaction. The attacker first seeds the vulnerable session value, then triggers the unauthenticated deletion endpoint to remove the chosen file.

See the WPScan Vulnerability Advisory for additional technical context. No verified public exploit code is published at the time of writing.

Detection Methods for CVE-2026-107594

Indicators of Compromise

Missing or truncated wp-config.php, .htaccess, or index.php files in the WordPress root directory
Unexpected WordPress setup wizard (/wp-admin/setup-config.php) served to visitors
Access log entries targeting plugin AJAX or admin-post endpoints associated with File Upload to Order from unauthenticated clients
New administrator accounts or altered database connection strings following a deletion event

Detection Strategies

Hunt web server logs for repeated requests to File Upload to Order plugin endpoints that include ../ sequences or absolute paths in parameters
Alert when WordPress core files are deleted or modified outside of a planned maintenance window
Monitor PHP session storage directories for unusual writes from unauthenticated sessions preceding delete requests

Monitoring Recommendations

Enable file integrity monitoring on the WordPress root and wp-content directories
Forward WordPress and web server logs to a centralized analytics platform for correlation
Review plugin inventory for File Upload to Order and track installed versions across all managed sites

How to Mitigate CVE-2026-107594

Immediate Actions Required

Upgrade the File Upload to Order plugin to version 1.1.4 or later on every affected WordPress site
If the plugin cannot be updated immediately, deactivate and remove it until the patched version is deployed
Verify integrity of wp-config.php and other core files, and restore from a known-good backup if deletion is suspected
Rotate database credentials, WordPress secret keys, and administrator passwords after confirming no setup wizard was accessed by an attacker

Patch Information

The vendor fix is available in File Upload to Order version 1.1.4. Administrators should update through the WordPress plugin manager or by replacing plugin files from the official distribution. Confirm the installed version in the WordPress admin interface after the update.

Workarounds

Block requests to the vulnerable plugin endpoints at a web application firewall until patching is complete
Restrict filesystem permissions so the WordPress process cannot delete core files such as wp-config.php
Place the WordPress site behind authentication at the web server layer during patch deployment where feasible

bash

# Configuration example: WAF rule concept to block path traversal in plugin parameters
# Pseudocode for a ModSecurity-style rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1072026107594,\
   msg:'Block File Upload to Order traversal (CVE-2026-107594)'"
  SecRule ARGS|REQUEST_COOKIES|REQUEST_BODY "@rx (\.\./|/etc/|wp-config\.php)" "t:lowercase"