File Upload to Order WordPress plugin: Unauthenticated arbitrary file deletion
Summary
The File Upload to Order WordPress plugin before version 1.1.4 does not validate a file path taken from attacker-controlled session data before deleting it. The deletion action is reachable without authentication. An unauthenticated attacker can delete arbitrary files on the server, and deleting key files can lead to full compromise of the WordPress site.
Affected
- File Upload to Order WordPress plugin, all versions before 1.1.4
- Vendor and exact product page not confirmed by the sources
Fixed in
- Version 1.1.4 (according to the CVE description and WPScan; not yet confirmed by the plugin's own changelog)
Workaround
Unknown.
Exploitation
- CISA KEV: not listed
- No public exploit confirmed in the sources reviewed
- In-the-wild exploitation: unknown
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial
- EPSS scores conflict between sources (0% to 0.19%)
Our recommendation
- Inventory all WordPress sites and check for the File Upload to Order plugin
- Update the plugin to version 1.1.4 or later; if this is not possible, deactivate and remove it
- Check for unexplained missing files or site errors
- Keep current offline backups so that a damaged site can be restored
- Verify the fixed version on the plugin's own page before relying on it
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion wpscan.com
- EUVD-2026-100893 vulners.com
- PSIRT: CVE-2026-107594 psirt.com
- Vulners / Positive Technologies PT-2026-113672 vulners.com
- Threatint: CVE-2026-107594 cve.threatint.com
- Offseq: CVE-2026-107594 radar.offseq.com
- Strix: CVE-2026-107594 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:15.
Original description (NVD)
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.