CVE-2026-14314: WooCommerce Receipt Uploader Disclosure Flaw

CVE-2026-14314 Overview

CVE-2026-14314 affects the PeproDev WooCommerce Receipt Uploader WordPress plugin through version 2.8.0. The plugin fails to verify that a requested attachment belongs to the order referenced by its access token. Unauthenticated attackers can forge a token and disclose image attachments belonging to other customers, including uploaded payment receipts. The flaw is an Insecure Direct Object Reference (IDOR) that exposes sensitive customer payment data without authentication.

Critical Impact
Unauthenticated attackers can enumerate and download payment receipts uploaded by other WooCommerce customers, exposing financial and personally identifiable information.

Affected Products

PeproDev WooCommerce Receipt Uploader WordPress plugin, all versions through 2.8.0
WordPress sites running WooCommerce with the affected plugin installed
E-commerce stores accepting manual bank transfer or receipt-based payments through the plugin

Discovery Timeline

2026-08-06 - CVE-2026-14314 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-14314

Vulnerability Analysis

The plugin implements an attachment retrieval flow that uses an access token to authorize downloads of uploaded receipt images. The token is intended to bind a request to a specific WooCommerce order, so only the customer who placed that order can retrieve the associated attachment. The plugin does not enforce that binding when serving the file.

An attacker who forges or manipulates the token can request arbitrary attachment IDs. The server returns the attachment content regardless of whether it belongs to the order tied to the token. This exposes payment receipts uploaded by unrelated customers.

Because the request path is reachable without authentication, exploitation does not require an account on the WooCommerce store. The disclosed images typically contain bank transfer confirmations, account numbers, transaction identifiers, customer names, and other financial data.

Root Cause

The root cause is missing authorization on the attachment retrieval handler. The handler validates the token format but does not check that the requested attachment ID matches the order the token was issued for. This is a classic broken access control pattern [CWE-639, Authorization Bypass Through User-Controlled Key].

Attack Vector

An attacker crafts a request to the plugin's attachment endpoint with a forged token and an incrementing or guessed attachment identifier. The server returns the referenced image without checking ownership. Repeated requests allow bulk enumeration of receipts stored across all orders.

Exploitation requires only HTTP access to the target WooCommerce site. See the WPScan Vulnerability Report for the technical writeup.

Detection Methods for CVE-2026-14314

Indicators of Compromise

Unauthenticated HTTP requests to the plugin's receipt or attachment endpoints with sequential or varied attachment IDs from a single source
Web server access logs showing successful 200 responses returning image content to clients with no associated WooCommerce session
High-volume image downloads from IP addresses that never completed a checkout on the store

Detection Strategies

Review WordPress and web server logs for repeated requests to the PeproDev receipt endpoint containing token parameters and varying attachment identifiers
Deploy a Web Application Firewall (WAF) rule that flags anonymous access to receipt attachment URLs at a rate inconsistent with normal customer behavior
Correlate outbound file transfer sizes with expected order volume to surface bulk receipt exfiltration

Monitoring Recommendations

Alert on any unauthenticated request that returns a WordPress media attachment tied to a WooCommerce order
Track access token reuse patterns; the same token requesting many distinct attachment IDs is a strong exploitation signal
Monitor the WordPress uploads directory for unusual bulk read access, especially to subdirectories used by the plugin

How to Mitigate CVE-2026-14314

Immediate Actions Required

Disable the PeproDev WooCommerce Receipt Uploader plugin until a patched release is confirmed
Rotate any customer-facing tokens issued by the plugin and invalidate cached download URLs
Audit web server logs for prior exploitation and notify affected customers if receipts were disclosed

Patch Information

No fixed version is identified in the published advisory at the time of writing. Versions through 2.8.0 are affected. Monitor the WPScan Vulnerability Report and the plugin's official channels for a security release, then update immediately once available.

Workarounds

Remove the plugin and switch to an alternative receipt handling workflow, such as manual email submission stored outside the WordPress media library
Restrict access to the plugin's attachment endpoints at the web server or WAF layer to authenticated WooCommerce sessions only
Move uploaded receipts out of the publicly accessible uploads directory and serve them through a hardened handler that enforces order ownership

bash

# Example nginx rule to block unauthenticated access to the plugin's attachment endpoint
location ~* /wp-content/plugins/pepro-wc-receipt-uploader/ {
    deny all;
    return 403;
}