CVE-2026-14313: PeproDev WooCommerce Auth Bypass Flaw

CVE-2026-14313 Overview

CVE-2026-14313 affects the PeproDev WooCommerce Receipt Uploader WordPress plugin (pepro-bacs-receipt-upload-for-woocommerce) through version 2.8.0. The plugin contains a missing-authorization flaw combined with an Insecure Direct Object Reference (IDOR) that allows unauthenticated attackers to perform write operations. Exploitation does not require authentication or user interaction. The plugin depends on WooCommerce, so affected sites run an e-commerce stack where receipt data is directly tied to customer orders. No fixed version is available at the time of writing.

Critical Impact
Unauthenticated attackers can invoke write actions against arbitrary receipt objects on any vulnerable WordPress site running the plugin with WooCommerce.

Affected Products

PeproDev WooCommerce Receipt Uploader plugin, all versions through 2.8.0
WordPress sites running the pepro-bacs-receipt-upload-for-woocommerce slug
WooCommerce-enabled installations (WooCommerce is a runtime dependency)

Discovery Timeline

2026-08-06 - CVE-2026-14313 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-14313

Vulnerability Analysis

The plugin exposes write endpoints without validating that the requester is authenticated or authorized for the referenced object. Because the endpoints accept a direct object identifier without a capability check, an attacker can supply another user's receipt or order reference and trigger a write action. This is a classic combination of missing authorization [CWE-862] and insecure direct object reference [CWE-639]. The result is that server-side state tied to a customer order can be modified by an unauthenticated caller. In a WooCommerce context, this typically means receipt records associated with pending bank-transfer (BACS) orders, which are used by store operators to confirm payment.

Root Cause

The underlying defect is the absence of current_user_can() or equivalent capability checks on plugin request handlers that accept object identifiers. Nonce verification alone, or no verification at all, is used to gate operations that should require an authenticated store manager or the owning customer. The handler trusts the identifier provided in the request and writes to that record without confirming the caller has rights over it.

Attack Vector

An attacker sends a crafted HTTP request to the plugin's write endpoint over the network. The request references a receipt or order identifier belonging to another user. No cookies, tokens, or user accounts are needed. The server processes the request and performs the write, altering data associated with the targeted order. Automated abuse against enumerable numeric identifiers is straightforward.

No verified public exploit code is available. See the WPScan Vulnerability Details for the advisory record.

Detection Methods for CVE-2026-14313

Indicators of Compromise

Unauthenticated POST requests to plugin endpoints under the pepro-bacs-receipt-upload-for-woocommerce path or its AJAX actions
Requests containing sequential or enumerated order_id, receipt_id, or similar identifier parameters from a single source IP
WooCommerce order metadata or receipt records changing without corresponding admin or customer session activity
Newly uploaded receipt files on orders that customers did not modify

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php or REST routes tied to the plugin slug without an authenticated session cookie
Correlate WordPress audit logs of receipt or order metadata changes against active user sessions to surface orphaned writes
Alert on high-rate requests iterating numeric object identifiers against plugin endpoints

Monitoring Recommendations

Enable a WordPress activity log plugin that records receipt uploads and order metadata mutations with source IP attribution
Forward WordPress and WooCommerce logs to a centralized SIEM for correlation with web access logs
Monitor for anomalous file uploads in the WordPress uploads directory tied to the plugin's storage path

How to Mitigate CVE-2026-14313

Immediate Actions Required

Deactivate and remove the PeproDev WooCommerce Receipt Uploader plugin until a fixed version is released
Restrict access to the plugin's endpoints at the web server or WAF layer to authenticated sessions only
Audit WooCommerce orders in BACS or pending-payment state for unexpected receipt changes since the plugin was installed

Patch Information

No fixed version is available at the time of writing. Version 2.8.0 remains the latest release on wordpress.org. Track the WPScan advisory for vendor updates and apply a vendor patch as soon as it is published.

Workarounds

Block unauthenticated requests to the plugin's AJAX and REST endpoints using a web application firewall rule
Replace the plugin with an alternative receipt-upload mechanism that enforces WooCommerce customer-session checks
If the plugin cannot be removed, place the site behind an authentication gateway for the affected paths

bash

# Example nginx rule to block unauthenticated access to the plugin's AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^pepro_bacs_") {
        # Require a logged-in WordPress cookie; otherwise deny
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}