Checkout Files Upload for WooCommerce: Unauthenticated Remote Code Execution (CVE-2026-103688)

The Checkout Files Upload for WooCommerce plugin (prior to version 2.4.0) contains an unauthenticated file upload vulnerability tracked as CVE-2026-103688. The vulnerability arises because the plugin fails to enforce file type validation if the "Accepted file types" setting is left blank. The AJAX action alg_ajax_file_upload is accessible to unauthenticated users via the wp_ajax_nopriv_ hook, and the required nonce is exposed to all visitors on the checkout page. Exploitation results in the ability to upload executable PHP files to a public web directory, facilitating remote code execution.

Attack Chain

1. An attacker identifies a WordPress site running the Checkout Files Upload plugin with an empty "Accepted file types" configuration.
2. The attacker visits the checkout page to retrieve a valid nonce for the wpwham-checkout-files-upload-0 action.
3. The attacker submits a multipart/form-data request to /wp-admin/admin-ajax.php containing the nonce, file_uploader identifier, and a malicious PHP file.
4. The plugin stores the malicious file in a temporary location and moves it to wp-content/uploads/woocommerce_uploads/alg_uploads/checkout_files_upload/ upon order creation or submission.
5. The attacker requests the uploaded PHP file directly via the web server to execute arbitrary code with the privileges of the web service user.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server, leading to full site compromise, data exfiltration, and potential lateral movement within the hosting environment.

Recommendation

• Update the "Checkout Files Upload for WooCommerce" plugin to version 2.4.0 or later immediately.
• If immediate patching is not possible, configure an explicit "Accepted file types" allow-list (e.g., jpg,jpeg,png,pdf) for every uploader instance in the plugin settings.
• Block direct PHP execution in the uploads directory by adding the following directive to your web server configuration (Nginx or Apache) to prevent webshell execution.
• Audit the wp-content/uploads/woocommerce_uploads/alg_uploads/checkout_files_upload/ directory for any unexpected files.