Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-103688 EUVD-2026-111699GHSA-h6g6-j3rf-hcqm

Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload

Published Oct 28, 2026 · Updated Oct 28, 2026 · Assigned by WPScan

Category: Web / CMS

Description

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.

Affected products

VendorProductAffectedFixed
— Checkout Files Upload for WooCommerce < 2.4.0 2.4.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • noxcrypt-x/CVE-2026-103688 ★ 3 · Oct 30, 2026

    CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References