{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/checkout-files-upload-for-woocommerce--2.4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpwham:checkout_files_upload:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-103688"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Checkout Files Upload for WooCommerce (\u003c 2.4.0)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","webshell","remote-code-execution","file-upload"],"_cs_type":"advisory","_cs_vendors":["WP Wham"],"content_html":"\u003cp\u003eThe Checkout Files Upload for WooCommerce plugin (prior to version 2.4.0) contains an unauthenticated file upload vulnerability tracked as CVE-2026-103688. The vulnerability arises because the plugin fails to enforce file type validation if the \u0026quot;Accepted file types\u0026quot; setting is left blank. The AJAX action \u003ccode\u003ealg_ajax_file_upload\u003c/code\u003e is accessible to unauthenticated users via the \u003ccode\u003ewp_ajax_nopriv_\u003c/code\u003e hook, and the required nonce is exposed to all visitors on the checkout page. Exploitation results in the ability to upload executable PHP files to a public web directory, facilitating remote code execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a WordPress site running the Checkout Files Upload plugin with an empty \u0026quot;Accepted file types\u0026quot; configuration.\u003c/li\u003e\n\u003cli\u003eThe attacker visits the checkout page to retrieve a valid nonce for the \u003ccode\u003ewpwham-checkout-files-upload-0\u003c/code\u003e action.\u003c/li\u003e\n\u003cli\u003eThe attacker submits a \u003ccode\u003emultipart/form-data\u003c/code\u003e request to \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e containing the nonce, \u003ccode\u003efile_uploader\u003c/code\u003e identifier, and a malicious PHP file.\u003c/li\u003e\n\u003cli\u003eThe plugin stores the malicious file in a temporary location and moves it to \u003ccode\u003ewp-content/uploads/woocommerce_uploads/alg_uploads/checkout_files_upload/\u003c/code\u003e upon order creation or submission.\u003c/li\u003e\n\u003cli\u003eThe attacker requests the uploaded PHP file directly via the web server to execute arbitrary code with the privileges of the web service user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server, leading to full site compromise, data exfiltration, and potential lateral movement within the hosting environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Checkout Files Upload for WooCommerce\u0026quot; plugin to version 2.4.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, configure an explicit \u0026quot;Accepted file types\u0026quot; allow-list (e.g., jpg,jpeg,png,pdf) for every uploader instance in the plugin settings.\u003c/li\u003e\n\u003cli\u003eBlock direct PHP execution in the uploads directory by adding the following directive to your web server configuration (Nginx or Apache) to prevent webshell execution.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003ewp-content/uploads/woocommerce_uploads/alg_uploads/checkout_files_upload/\u003c/code\u003e directory for any unexpected files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T00:04:37Z","date_published":"2026-10-31T00:04:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-checkout-files-upload-rce/","summary":"An unauthenticated file upload vulnerability in the Checkout Files Upload for WooCommerce plugin allows remote attackers to execute arbitrary PHP code due to improper file type validation and exposed AJAX handlers.","title":"Checkout Files Upload for WooCommerce: Unauthenticated Remote Code Execution (CVE-2026-103688)","url":"https://feed.craftedsignal.io/briefs/2026-10-checkout-files-upload-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Checkout Files Upload for WooCommerce (\u003c 2.4.0)","version":"https://jsonfeed.org/version/1.1"}