CVE-2026-16054: Unknown Drag And Drop Multiple File Upload For Woocommerce

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

Affected products

• Unknown Drag And Drop Multiple File Upload For Woocommerce: before 1.1.8 (fixed in 1.1.8)

Published 2026-08-06. Last modified 2026-08-26.