CVE-2026-77693: WooCommerce Order Tip Privilege Escalation

CVE-2026-77693 Overview

The Order Tip for WooCommerce WordPress plugin contains an arbitrary file deletion vulnerability affecting all versions before 1.6.0. The plugin fails to verify user capabilities when handling file deletion requests and does not restrict which filesystem paths can be targeted. Authenticated users with the Shop Manager role or higher can delete arbitrary files on the server. Deleting critical files such as wp-config.php can trigger the WordPress setup flow, enabling site takeover by an attacker who reconfigures the installation against an attacker-controlled database.

Critical Impact
Authenticated Shop Manager accounts can delete any file readable by the web server process, leading to full WordPress site takeover.

Affected Products

Order Tip for WooCommerce WordPress plugin versions prior to 1.6.0
WordPress sites running WooCommerce with the vulnerable plugin installed
Any deployment exposing Shop Manager or higher role accounts to untrusted actors

Discovery Timeline

2026-08-26 - CVE-2026-77693 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77693

Vulnerability Analysis

The flaw is classified as External Control of File Name or Path [CWE-73]. The plugin exposes a file deletion handler that accepts a user-supplied path parameter and passes it to a deletion routine without validation. Two defenses are missing: capability checks that would restrict the action to administrators, and path sanitization that would confine deletions to plugin-owned directories.

Because the handler trusts the authenticated session and the input path, any user with the Shop Manager role can traverse the filesystem and remove files owned by the web server user. WordPress installations commonly grant Shop Manager to staff members handling orders, expanding the pool of accounts capable of triggering the issue.

Deletion of wp-config.php is the canonical takeover primitive. Once the file is removed, WordPress redirects visitors to the installation wizard. An attacker completes the wizard using an attacker-controlled database, gaining administrative access. From that position, attackers install malicious plugins, upload web shells, and pivot to the underlying host.

Root Cause

The root cause is the absence of both authorization checks and path restrictions in the plugin's file deletion endpoint. WordPress plugins are expected to call current_user_can() with an appropriate capability before privileged actions and to constrain filesystem operations to known directories.

Attack Vector

Exploitation requires network access to the WordPress admin interface and valid credentials for a Shop Manager or higher account. The attacker issues the plugin's file deletion request with a path pointing to a target file such as wp-config.php. No user interaction from another user is required. Refer to the WPScan Vulnerability Report for the specific request format.

// No verified proof-of-concept code is published.
// See the WPScan advisory for technical details on the vulnerable endpoint.

Detection Methods for CVE-2026-77693

Indicators of Compromise

Unexpected deletion or absence of wp-config.php, .htaccess, or core WordPress files
Web server access logs showing authenticated requests to the plugin's admin-ajax or REST endpoints referencing a file or path parameter with directory traversal sequences
WordPress installation wizard appearing on a previously configured site
New administrator accounts created after suspicious file deletion events

Detection Strategies

Compare installed Order Tip for WooCommerce plugin versions against 1.6.0 across all managed WordPress hosts
Monitor filesystem audit logs for unlink() operations on WordPress core files initiated by the PHP-FPM or Apache user
Alert on HTTP requests to plugin endpoints containing ../ sequences or absolute paths in POST parameters

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, .htaccess, and the WordPress core directory
Forward web server and PHP error logs to a central analytics platform to correlate deletion events with authenticated sessions
Track creation of new WordPress administrator accounts and installation of new plugins following any file integrity alert

How to Mitigate CVE-2026-77693

Immediate Actions Required

Update the Order Tip for WooCommerce plugin to version 1.6.0 or later on all WordPress installations
Audit accounts assigned the Shop Manager role and revoke access for users who do not require it
Rotate WordPress administrator and Shop Manager credentials and enforce multi-factor authentication on wp-admin
Review filesystem and web server logs for evidence of prior exploitation

Patch Information

The vendor fixed the vulnerability in Order Tip for WooCommerce version 1.6.0 by adding capability checks and path restrictions to the file deletion handler. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Order Tip for WooCommerce plugin until the update to 1.6.0 is applied
Restrict wp-admin access to trusted IP ranges using web server ACLs or a web application firewall
Set the WordPress filesystem to read-only for the web server user where deployment constraints allow, preventing arbitrary deletion

bash

# Update the plugin via WP-CLI on all managed sites
wp plugin update order-tip-for-woocommerce --version=1.6.0
wp plugin list --name=order-tip-for-woocommerce --fields=name,version,status