10

CVE-2026-107594

CVSS: 10.0v3.1CriticalDeferred
Published 2026-10-14Last modified 2026-10-14
Open JSON

Vulnerability summary

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (cve.org)
EPSS score
0.19%
0%100%
Low · Change unavailable
KEVNot listed0 of 3 catalogs
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 2026-10-14
    PublishedVulnerability first disclosed.
  2. 2026-10-14
    Last modifiedVulnerability information updated.

Description

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

8%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

2026-10-142026-10-14
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (wpscan.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Unknown1 product
  • file upload to order< 1.1.4

1 vendor · 1 product

References

1 links