{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24625", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:28.686Z", "datePublished": "2026-01-23T14:29:07.478Z", "dateUpdated": "2026-04-28T16:14:50.636Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woo-addon-uploads", "product": "File Uploads Addon for WooCommerce", "vendor": "Imaginate Solutions", "versions": [{"changes": [{"at": "1.7.4", "status": "unaffected"}], "lessThanOrEqual": "1.7.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Arif Shaikh | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:51.185Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects File Uploads Addon for WooCommerce: from n/a through <= 1.7.3.</p>"}], "value": "Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through <= 1.7.3."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:50.636Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woo-addon-uploads/vulnerability/wordpress-file-uploads-addon-for-woocommerce-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T17:04:58.046426Z", "id": "CVE-2026-24625", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:46:18.696Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24625", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T17:04:58.046426Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T17:04:53.174Z"}}], "cna": {"title": "WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Arif Shaikh | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Imaginate Solutions", "product": "File Uploads Addon for WooCommerce", "versions": [{"status": "affected", "changes": [{"at": "1.7.4", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.7.3"}], "packageName": "woo-addon-uploads", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:27.267Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/woo-addon-uploads/vulnerability/wordpress-file-uploads-addon-for-woocommerce-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through <= 1.7.3.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects File Uploads Addon for WooCommerce: from n/a through <= 1.7.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:46.140Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24625", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:46:18.696Z", "dateReserved": "2026-01-23T12:32:28.686Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:29:07.478Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through <= 1.7.3."}, {"lang": "es", "value": "Vulnerabilidad por falta de autorizaci\u00f3n en el Complemento de Carga de Archivos de Imaginate Solutions para WooCommerce woo-addon-uploads permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta al Complemento de Carga de Archivos para WooCommerce: desde n/a hasta &lt;= 1.7.3."}], "id": "CVE-2026-24625", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-01-23T15:16:21.767", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/woo-addon-uploads/vulnerability/wordpress-file-uploads-addon-for-woocommerce-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:10:33.914547+00:00", "value": {"mitigation_remediation": ["Install the latest version of the File Uploads Addon for WooCommerce that includes the authorization fix, if one is available; otherwise verify the vendor\u2019s release notes for a patch.", "Configure WordPress or the plugin to allow file uploads only for users with the appropriate role (e.g., administrator or vendor), ensuring that the upload endpoint is not publicly accessible.", "Restrict the uploaded file types, impose a maximum file size, and configure the server to prevent execution of files in the upload directory."], "summary": {"action": "Update Plugin", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has installed the File Uploads Addon for WooCommerce plugin from its earliest public release up to and including version\u202f1.7.3 is affected. The CVE record specifies no constraints on operating system or WordPress core version, so all installations running those plugin versions are at risk.", "description_and_impact": "The vulnerability is a missing authorization check (CWE\u2011862) in Imaginate Solutions File Uploads Addon for WooCommerce. The plugin\u2019s file upload handler does not enforce proper authentication, allowing users to trigger uploads without appropriate permissions. The CVE text states that this flaw can be exploited by incorrectly configured access control security levels, potentially allowing attackers to place arbitrary files in the WordPress upload directory. It is inferred that such uploaded content could be used for further attacks if the server later executes or serves the files.", "risk_and_exploitability": "The CVSS score of 5.3 classifies the flaw as medium severity, while the EPSS score of less than 1\u202f% indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Targeted exploitation would involve accessing the plugin\u2019s upload endpoint; it is inferred that attackers would likely target sites that expose this endpoint to unauthenticated or insufficiently privileged users, thereby lowering the practical exposure compared to a site that restricts upload access."}}}}, "created": "2026-01-26T11:53:25.619271+00:00", "updated": "2026-04-18T03:15:35.429689+00:00", "vendors": ["imaginate-solutions", "imaginate-solutions$PRODUCT$file_uploads_addon_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}