CVE-2026-16054: WooCommerce File Upload Auth Bypass Flaw

CVE-2026-16054 Overview

CVE-2026-16054 affects the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin in versions before 1.1.8. The plugin exposes a file-deletion routine gated only by a nonce that unauthenticated users can obtain. Anonymous attackers can request that nonce and then invoke the deletion endpoint to remove files staged in the plugin's upload directory. The impact is irreversible destruction of pending order attachments uploaded by WooCommerce customers.

Critical Impact
Unauthenticated attackers can permanently delete customer file uploads staged for pending WooCommerce orders, corrupting order fulfillment data.

Affected Products

Drag and Drop Multiple File Upload for WooCommerce WordPress plugin versions prior to 1.1.8
WooCommerce storefronts that accept customer file attachments through this plugin
WordPress sites relying on the plugin's default upload directory for order data

Discovery Timeline

2026-08-06 - CVE-2026-16054 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-16054

Vulnerability Analysis

The plugin exposes a file-deletion AJAX handler intended to let a customer remove a file they just uploaded before submitting an order. Access to that handler is controlled by a single WordPress nonce. The plugin also exposes an endpoint reachable by unauthenticated visitors that returns a valid nonce for the deletion action.

An attacker with no account can request the nonce, replay it against the deletion endpoint, and specify the filename to remove. Because the deletion routine performs no capability check, ownership check, or session binding, the request succeeds. The result is broken access control on a state-changing file operation.

The vulnerability is categorized as broken access control and missing authorization on a destructive action. Deleted files are unrecoverable through the plugin, and the corresponding WooCommerce orders lose their attached assets.

Root Cause

The root cause is treating a nonce as an authorization control rather than a CSRF control. Nonces confirm request intent; they do not establish that the caller is authorized to delete a resource. Because the nonce issuance endpoint is public, the gating check adds no security value against anonymous attackers.

Attack Vector

The attack requires only network access to the WordPress site. An attacker fetches a valid nonce from the plugin's public endpoint, then issues an HTTP request to the AJAX deletion action with the target filename. Filenames staged by the plugin can be enumerated or guessed based on the plugin's predictable naming pattern in its upload directory.

See the WPScan Vulnerability Report for full technical detail.

Detection Methods for CVE-2026-16054

Indicators of Compromise

Unauthenticated admin-ajax.php POST requests referencing the plugin's file-deletion action from external IP addresses
Requests to the plugin's public nonce endpoint immediately followed by deletion requests from the same source
Missing files in the plugin's WooCommerce upload directory that correspond to pending or recent orders
Customer support reports of attachments disappearing from submitted orders

Detection Strategies

Alert on high-volume anonymous requests to admin-ajax.php that reference the plugin's deletion action name
Correlate nonce-issuance requests with deletion requests originating from the same IP within a short interval
Monitor the plugin's upload directory for delete operations that are not preceded by an authenticated administrator session

Monitoring Recommendations

Enable filesystem auditing on the plugin's upload directory to record every unlink operation with process context
Ship WordPress and web server logs to a central store and retain them long enough to reconstruct order-attachment activity
Track a baseline of daily deletion counts for the upload directory and alert on statistical spikes

How to Mitigate CVE-2026-16054

Immediate Actions Required

Update the Drag and Drop Multiple File Upload for WooCommerce plugin to version 1.1.8 or later
Audit the plugin's upload directory against WooCommerce order records to identify already-deleted attachments
Restore missing attachments from backups where available and contact affected customers to resubmit files

Patch Information

Version 1.1.8 of the plugin addresses the vulnerability. Administrators should update through the WordPress plugin manager or by replacing the plugin files with the patched release. Refer to the WPScan Vulnerability Report for the referenced fix.

Workarounds

Deactivate the plugin until patching is possible if customer uploads are not currently required
Restrict access to admin-ajax.php for the plugin's deletion action at the web application firewall layer
Take frequent backups of the plugin's upload directory so deleted attachments can be restored quickly

bash

# Update the plugin using WP-CLI
wp plugin update drag-and-drop-multiple-file-upload-woocommerce --version=1.1.8
wp plugin list --name=drag-and-drop-multiple-file-upload-woocommerce