CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103688
CRITICALCVSS 9.8NVD feed
Published 28 October 2026 · tracked since 28 October 2026
Description
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-118683 HIGH 8.8
- CVE-2026-118680 MEDIUM 4.4
- CVE-2026-118645 HIGH 8.7
- CVE-2026-118265 MEDIUM 5.3
- CVE-2026-118641 HIGH 7.5
- CVE-2026-118257 HIGH 7.2
- CVE-2026-106484 MEDIUM 4.4
- CVE-2026-79656 MEDIUM 6
- CVE-2026-110181 MEDIUM 6.5
- CVE-2026-105620 MEDIUM 6.5