CVE-2026-13607EPSS p19.8%
CVE-2026-13607CVE-2026-13607
Description
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
Scoring
| CVSS | 5.9 () |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 0.29% probability of exploitation · percentile 19.8% · 2026-10-10T12:00:23Z |
| Last modified | 2026-10-06 |