CVE-2026-13607
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 05, 2026
Vendor
unknown
Description
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.