Unauthenticated Arbitrary File Upload in MIPL Grouped Checkout Fields for WooCommerce

The MIPL Grouped Checkout Fields for WooCommerce - Customize & Organize Checkout Fields plugin for WordPress contains a critical arbitrary file upload vulnerability (CVE-2026-8778) affecting all versions up to and including 1.2.1. The vulnerability resides within the mipl_wc_upload_file function, which fails to implement proper server-side validation of uploaded file types.

This flaw allows unauthenticated remote attackers to upload arbitrary files, such as malicious PHP web shells, directly to the web server's filesystem. Once uploaded, these files can be executed by accessing the file path via a web request, facilitating remote code execution (RCE). The impact is high given the plugin's function is to handle checkout data, which often resides in a publicly accessible directory or is otherwise reachable by external attackers. Defenders must ensure all instances of this plugin are updated to a version beyond 1.2.1 if available, or restrict access to the affected endpoints.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the underlying web server. This can lead to complete site compromise, exfiltration of sensitive WooCommerce customer data, or lateral movement within the hosting infrastructure.

Recommendation

• Upgrade the "MIPL Grouped Checkout Fields for WooCommerce" plugin to a version later than 1.2.1 immediately once a patch is available.
• Monitor web access logs for suspicious HTTP POST requests directed toward mipl_wc_upload_file endpoints.
• Implement restrictive filesystem permissions on the WordPress uploads directory to prevent the execution of uploaded files (e.g., via .htaccess or server configuration).