CVE-2026-13607: Unknown File Uploads Addon For Woocommerce

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.

Affected products

• Unknown File Uploads Addon For Woocommerce: from 1.7.2, up to and including 1.7.6

Published 2026-10-05. Last modified 2026-10-06.