---
id: CVE-2026-103688
title: >-
  Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File
  Upload
summary: >-
  The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does
  not validate uploaded file types when its accepted file types setting is left
  empty, which it documents as the way to accept all files, allowing
  unauthenticated…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-434
product: Checkout Files Upload for WooCommerce
affected:
  - checkout_files_upload_for_woocommerce < 2.4.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-28T17:50:16.310569Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:09.254Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103688'
references:
  - url: 'https://wpscan.com/vulnerability/08777aa1-6308-4e99-b2d0-5e43209aa6a6/'
tags:
  - cve.org
  - exploit-available
epss: 0.00611
epssPercentile: 0.49527
ingestedAt: '2026-10-28T07:06:27.173Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/noxcrypt-x/CVE-2026-103688'
  checkedAt: '2026-11-08T19:05:35.842Z'
exploitAvailable: true
---

## Overview

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.

## Affected

- `checkout_files_upload_for_woocommerce < 2.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.