CVE-2026-13607: WooCommerce File Uploads Information Disclosure

CVE-2026-13607 Overview

CVE-2026-13607 affects the File Uploads Addon for WooCommerce WordPress plugin through version 1.7.6. The plugin stores customer-uploaded files in a publicly web-accessible uploads directory. The access restriction it generates is ineffective, allowing unauthenticated attackers to retrieve customer files directly. Attackers who know or guess a file name bypass the plugin's authenticated download mechanism entirely. The flaw is categorized as improper access control [CWE-284].

Critical Impact
Unauthenticated attackers can retrieve customer-uploaded files from affected WooCommerce stores by guessing or discovering file names, exposing potentially sensitive customer data.

Affected Products

File Uploads Addon for WooCommerce WordPress plugin
All versions through 1.7.6
WordPress sites running WooCommerce with this addon enabled

Discovery Timeline

2026-10-05 - CVE-2026-13607 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-13607

Vulnerability Analysis

The File Uploads Addon for WooCommerce extends WooCommerce product pages with a file upload field, enabling customers to attach files to orders. The plugin is designed to gate access to those uploads behind an authenticated download handler. In practice, the files land in a web-accessible directory inside wp-content/uploads/, and the access control the plugin generates fails to block direct requests.

An unauthenticated attacker who learns or guesses the stored file name retrieves the file directly over HTTP. The authenticated download endpoint is bypassed entirely. Customer-submitted documents, identity artifacts, and order attachments are exposed as a result.

Root Cause

The root cause is improper access control [CWE-284]. The plugin relies on obscurity of the file path rather than enforcing authorization at the web server layer. Protection mechanisms such as a .htaccess deny rule, randomized unguessable paths, or storage outside the web root are either absent or ineffective. Any request to the uploads directory is served directly by the web server without consulting the plugin's permission logic.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker enumerates or guesses file names in the plugin's upload directory and issues a direct GET request. Predictable naming patterns, information disclosure through order confirmation pages, or directory indexing increase the success rate. The vulnerability affects confidentiality only; integrity and availability remain intact.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-13607

Indicators of Compromise

Unauthenticated GET requests to paths under wp-content/uploads/ associated with the File Uploads Addon directory
High-volume sequential or dictionary-style requests against upload file names from a single source IP
Successful 200 OK responses to upload paths from clients with no prior authenticated session cookie
Requests from unexpected geographies or user agents targeting WooCommerce upload directories

Detection Strategies

Review web server access logs for direct retrieval of files in the plugin's uploads path without a referring authenticated request
Correlate upload file names recorded in WooCommerce order metadata against external access patterns
Deploy web application firewall rules that identify enumeration behavior targeting wp-content/uploads/ subdirectories

Monitoring Recommendations

Enable detailed HTTP access logging on the WordPress host and forward logs to a central analytics platform
Alert on anomalous request rates to the WooCommerce file upload directory
Track 404 and 200 ratios for upload paths to identify brute-force file name guessing

How to Mitigate CVE-2026-13607

Immediate Actions Required

Audit the File Uploads Addon for WooCommerce plugin version and confirm whether versions through 1.7.6 are deployed
Deny direct web access to the plugin's upload directory at the web server configuration layer
Review historical access logs for signs of unauthenticated retrieval of customer files
Notify affected customers if exposure of personal data is confirmed, consistent with applicable privacy regulations

Patch Information

No fixed version is identified in the enriched CVE data at the time of publication. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for a patched release. Until a patched version is available, apply the workarounds below.

Workarounds

Block direct HTTP access to the plugin's uploads directory via web server rules, forcing all retrieval through the plugin's authenticated handler
Move customer-uploaded files outside the web root and serve them exclusively through an authorization-checked PHP handler
Rename stored files using cryptographically random identifiers to reduce guessability as a defense-in-depth measure
Disable the plugin on production stores handling sensitive customer documents until a patch is released

bash

# Example Apache .htaccess rule to deny direct access to the plugin uploads directory
# Place inside wp-content/uploads/wc-uploads/ or the plugin's upload path
<FilesMatch ".*">
    Require all denied
</FilesMatch>

# Example Nginx equivalent
# location ^~ /wp-content/uploads/wc-uploads/ {
#     deny all;
#     return 403;
# }