CVE-2026-78371: WooCommerce File Uploads Information Leak

CVE-2026-78371 Overview

CVE-2026-78371 affects the File Uploads Addon for WooCommerce WordPress plugin in versions prior to 1.7.6. The plugin fails to verify that the user requesting a customer-uploaded file is the original uploader. Unauthenticated attackers who know or guess a file name can download other customers' uploaded files. The flaw is classified as an Insecure Direct Object Reference under CWE-639. It affects the confidentiality of customer-supplied data processed through WooCommerce order workflows, which may include identification documents, invoices, or other sensitive attachments.

Critical Impact
Unauthenticated attackers can retrieve arbitrary customer-uploaded files by guessing or discovering file names, exposing confidential order attachments.

Affected Products

File Uploads Addon for WooCommerce WordPress plugin versions prior to 1.7.6
WordPress sites running WooCommerce with the vulnerable plugin installed
Any WooCommerce storefront accepting customer file uploads through this addon

Discovery Timeline

2026-10-05 - CVE-2026-78371 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-78371

Vulnerability Analysis

The File Uploads Addon for WooCommerce accepts files from customers during checkout and stores them for retrieval by shop administrators and the uploading customer. The plugin exposes a download endpoint that returns a file based on an identifier derived from the file name. The endpoint does not confirm that the requester owns the order or session associated with the file. Any party that supplies a valid file name receives the content.

The issue falls under Authorization Bypass Through User-Controlled Key [CWE-639]. The plugin treats knowledge of the file name as sufficient authorization. File names in e-commerce workflows are often predictable, derived from the original client-side name, timestamps, or sequential identifiers. See the WPScan Vulnerability Report for additional detail.

Root Cause

The download handler omits ownership checks. The code path should correlate the requested file with the authenticated customer's order history or a signed, single-use token. Instead, the handler resolves the file name directly from the request and returns the stored object without session or capability validation.

Attack Vector

An unauthenticated attacker sends crafted HTTP GET or POST requests to the plugin's file retrieval endpoint. The attacker iterates through probable file names, including values enumerated from public order confirmation pages, leaked emails, or predictable naming schemes. Successful requests return the raw file contents. The attack requires network access to the storefront and no user interaction.

No verified public exploit code is available at the time of publication. The vulnerability mechanism is documented in the referenced advisory.

Detection Methods for CVE-2026-78371

Indicators of Compromise

Repeated GET or POST requests to the File Uploads Addon download endpoint from a single IP address with varying file name parameters
HTTP 200 responses to unauthenticated requests referencing customer upload paths
Access log entries showing high ratios of file name enumeration attempts against the plugin's handler
Spikes in outbound bandwidth from the WordPress host tied to the plugin's upload directory

Detection Strategies

Parse WordPress access logs for sequential or dictionary-style requests targeting the plugin's download URL
Alert on anonymous sessions retrieving multiple distinct customer files within a short interval
Compare request source IPs against known customer sessions and flag mismatches

Monitoring Recommendations

Forward web server, WordPress, and WAF logs to a centralized analytics platform for correlation
Baseline normal download volumes per customer and alert on deviations
Monitor the plugin's upload directory for anomalous read access patterns at the file system level

How to Mitigate CVE-2026-78371

Immediate Actions Required

Upgrade the File Uploads Addon for WooCommerce plugin to version 1.7.6 or later on all WordPress sites
Audit web server access logs for prior unauthorized downloads of customer-uploaded files
Notify affected customers if evidence of unauthorized access is identified during the audit
Rotate or invalidate any sensitive documents collected through the plugin that may have been exposed

Patch Information

The vendor addressed the authorization flaw in version 1.7.6 of the File Uploads Addon for WooCommerce. Administrators should apply the update through the WordPress plugin management interface or by replacing the plugin files directly. Confirm the installed version after upgrade. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the File Uploads Addon for WooCommerce plugin until the patched version is installed
Restrict access to the plugin's upload directory with web server rules that require an authenticated session cookie
Deploy a WAF rule that blocks unauthenticated requests to the plugin's download endpoint
Rename or relocate stored customer uploads so prior file names cannot be guessed by external parties

bash

# Example Apache rule restricting the plugin download endpoint
# Place in the site .htaccess or VirtualHost configuration
<LocationMatch "/wp-content/uploads/wc-file-uploads/">
    Require valid-user
</LocationMatch>