CVE-2026-42725: WooCommerce Checkout Files Upload Bypass

CVE-2026-42725 Overview

CVE-2026-42725 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Wham Checkout Files Upload for WooCommerce plugin. The flaw stems from an authorization bypass through a user-controlled key [CWE-639], affecting all versions up to and including 2.2.5. Attackers can manipulate object identifiers to access files uploaded by other users during the WooCommerce checkout process. The vulnerability requires no authentication or user interaction and is exploitable over the network. Exploitation can lead to disclosure of sensitive customer-uploaded documents and limited integrity or availability impact on stored files.

Critical Impact
Unauthenticated attackers can access customer-uploaded checkout files belonging to other users by manipulating object reference parameters.

Affected Products

WP Wham Checkout Files Upload for WooCommerce plugin
All versions from n/a through 2.2.5
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2026-05-27 - CVE-2026-42725 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-42725

Vulnerability Analysis

The vulnerability is classified as Authorization Bypass Through User-Controlled Key [CWE-639], commonly referred to as Insecure Direct Object Reference (IDOR). The plugin permits customers to upload files during the WooCommerce checkout flow. These files are referenced by identifiers passed as request parameters. The plugin fails to verify that the requesting user owns or is authorized to access the referenced file. An attacker can iterate or guess identifiers to retrieve files uploaded by other shoppers. According to the Patchstack advisory, the issue affects all releases up to and including version 2.2.5.

Root Cause

The root cause is the absence of proper access control checks on file retrieval endpoints. The plugin trusts the user-supplied object identifier without validating whether the current session is authorized to access that resource. Authorization decisions rely solely on knowledge of the identifier rather than on session ownership or role-based checks.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker crafts HTTP requests to the file retrieval endpoint, substituting object reference values to enumerate files belonging to other users. Successful requests return file contents intended for other customers, exposing personally identifiable information (PII) or order-related documents.

No verified public proof-of-concept code is currently available. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-42725

Indicators of Compromise

HTTP requests to checkout file retrieval endpoints with sequential or enumerated identifier parameters
Repeated 200 OK responses to the same client across multiple distinct file identifiers
Access to uploaded checkout files from IP addresses not associated with the corresponding order or customer session
Unusual download volume from wp-content/uploads/ directories tied to the plugin

Detection Strategies

Inspect web server access logs for parameter tampering patterns against the plugin's file download handler
Correlate requesting session or user identifier with the owner of the requested file at the application layer
Deploy WordPress audit logging to track file access events from the Checkout Files Upload plugin
Alert on unauthenticated access to URLs that should require an authenticated session

Monitoring Recommendations

Monitor outbound bandwidth from the WordPress host for spikes that may indicate bulk file exfiltration
Track HTTP requests with high cardinality on a single object identifier parameter from one source IP
Review WooCommerce order logs against file access logs to find access events without matching orders

How to Mitigate CVE-2026-42725

Immediate Actions Required

Update the Checkout Files Upload for WooCommerce plugin to a version newer than 2.2.5 once released by WP Wham
Restrict access to uploaded checkout files at the web server level until a patch is applied
Audit existing uploaded files and access logs to identify potential prior exposure
Notify affected customers if log review confirms unauthorized access to their files

Patch Information

At the time of publication, the vulnerability affects all versions through 2.2.5. Administrators should monitor the Patchstack Vulnerability Report and the WP Wham plugin page for an official fixed release and apply it immediately when available.

Workarounds

Disable the Checkout Files Upload for WooCommerce plugin until a patched version is installed
Move uploaded checkout files outside the public web root and serve them through an authenticated proxy
Add web application firewall (WAF) rules to block unauthenticated requests to the plugin's file retrieval endpoints
Enforce session-based ownership checks at the reverse proxy by mapping file identifiers to authenticated users

bash

# Example WAF rule (ModSecurity) to block unauthenticated access to plugin file downloads
SecRule REQUEST_URI "@contains /checkout-files-upload" \
    "id:1042725,phase:1,deny,status:403,\
    chain,msg:'Block unauthenticated CFU file access (CVE-2026-42725)'"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"