CVE-2026-78371 — File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure

CVE-2026-78371

File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure PUBLISHED

Description (CNA)

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

Affected (CNA)

Vendor / product	Versions
Unknown / File Uploads Addon for WooCommerce	affected 1.7.2 before 1.7.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7a9cda53-c62a-4249-baf2-7f25feeed17a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.