CVE-2026-14314: Unknown Peprodev Woocommerce Receipt Uploader

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.

Affected products

• Unknown Peprodev Woocommerce Receipt Uploader: up to and including 2.8.0

Published 2026-08-06. Last modified 2026-08-26.