Checkout Files Upload for WooCommerce before 2.4.0 – Actively Exploited File Upload (CVE-2026-103688)
Checkout Files Upload for WooCommerce versions earlier than 2.4.0 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-103688. Patchstack lists the flaw as actively exploited and rates it CVSS 10.0. Update to version 2.4.0 or later immediately and investigate exposed stores for uploaded backdoors.
| Product | Checkout Files Upload for WooCommerce |
|---|---|
| Affected versions | Earlier than 2.4.0 |
| Fixed version | 2.4.0 |
| CVE | CVE-2026-103688 |
| Severity | Critical, CVSS 10.0 |
| Authentication | Not required |
| Attack class | Arbitrary file upload leading to possible remote code execution |
| Exploitation | Active exploitation reported by Patchstack |
| Install base | 7,000+ active installations on WordPress.org |
How the vulnerability works
WPScan reports that vulnerable releases fail to validate uploaded file types when the plugin’s accepted-file-types setting is left blank. The plugin documented a blank value as allowing all file types, which can permit unauthenticated users to upload dangerous files through a public WooCommerce upload form.
If the web server executes PHP from the destination upload directory, an uploaded script can provide remote code execution and full site takeover. Exploitation depends on the upload feature being publicly reachable and the accepted-file-types setting being blank, but Patchstack’s telemetry shows that attackers are already targeting the issue.
Immediate remediation
- Update Checkout Files Upload for WooCommerce to version 2.4.0 or later.
- If an immediate update is impossible, deactivate the plugin or remove its upload forms from public pages until the update is complete.
- Do not rely on adding extensions to the old accepted-file-types setting as a substitute for patching.
- Review web logs for unusual upload requests and follow-up requests to newly created files.
- Inspect WordPress upload directories for unexpected executable files, then review administrator accounts, active plugins, must-use plugins, cron hooks, and outbound connections.
Version 2.4.0 changes the risky behavior: leaving the accepted-file-types setting blank no longer permits every file type. The plugin now limits blank-setting uploads to file types allowed by WordPress; additional types must be explicitly configured.
Verify and update with WP-CLI
wp plugin get checkout-files-upload-woocommerce --fields=name,status,version,update,update_version
wp plugin update checkout-files-upload-woocommerce
wp plugin list --fields=name,status,version,update --format=table
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp plugin list --status=must-use --fields=name,status,version --format=table
wp cron event list --fields=hook,next_run_gmt,recurrence --format=table
wp core verify-checksums
wp cache flushConfirm the installed version is 2.4.0 or newer. Also review WooCommerce > Settings > Checkout Files Upload and explicitly define only the business-required file types.
Indicators to review
- Unexpected upload requests from unauthenticated visitors or automated clients.
- PHP, PHTML, PHAR, or other executable files below
wp-content/uploadsor plugin-managed upload directories. - Requests to newly created files immediately after an upload event.
- New administrators, unfamiliar plugins or must-use plugins, unknown scheduled tasks, changed options, or modified PHP files.
Updating closes the upload flaw but does not remove a backdoor that was already written. Preserve logs and suspicious files for investigation, restore from a known-good backup when appropriate, and rotate WordPress salts, administrator passwords, hosting credentials, database credentials, payment-service keys, and other reachable secrets if compromise is suspected.
Sources
