CVE-2026-16054CWE-73

CVE-2026-16054

Critical · published August 6, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00494 · 41.5th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-08-06T11:16Z
References (1)
https://wpscan.com/vulnerability/3be51346-5d4c-4889-bc5c-f40749bd182a/ · [email protected]
EPSS history
Timeline
  • 06 AUG 06:00Z
    Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
    cvelistv5