External risk intelligence

File Upload to Order WordPress Plugin Arbitrary File Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-107594

This vulnerability affects a WordPress plugin, which is typically deployed as a public-facing web application. Since the vulnerable file deletion action is reachable by unauthenticated users via the web interface, it is highly likely to be accessible from the internet in common deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security vulnerability in the File Upload to Order WordPress plugin. The issue allows unauthenticated users to delete arbitrary files on the server, potentially leading to a complete website compromise. This could impact the availability and integrity of your online services if this plugin is in use.

Allows deleting any server files.
Affects public-facing websites.
Confirm plugin use; potential for service disruption.

Attack Path

How an attacker could exploit the issue

An attacker can delete arbitrary files on a WordPress site by exploiting a weakness in the File Upload to Order plugin. This occurs because the plugin does not properly check file paths provided by an attacker, even if they are not logged in. Deleting critical files can lead to a complete takeover of the website.

Unauthenticated access to a web interface.
Deleting arbitrary files.
Full site compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to delete arbitrary files on a WordPress server. This occurs when the File Upload to Order plugin is used without proper validation of file paths. Removing critical system files could lead to a complete website compromise.

Arbitrary server files.
Unauthenticated file deletion.
Full website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a WordPress plugin is likely a shared responsibility between the application owner who manages the WordPress site and the infrastructure or platform team responsible for the underlying server environment. The first practical step is for the application owner to identify all WordPress instances, confirm which ones use the affected plugin, and assess exposure based on internet reachability and business criticality. This will enable proper risk-based prioritization and planning with the relevant teams.

Application owners should own this issue.
Verify plugin usage and internet exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the File Upload to Order WordPress plugin?

It is an add-on for WordPress websites designed to let customers attach files, such as documents or images, to their orders. Site administrators use this component to streamline order management and document collection directly through the e-commerce interface.

What does CVE-2026-107594 mean in plain English?

This vulnerability is classified as CWE-73, which involves improper control of file path names. Essentially, the plugin fails to verify where a file is located before deleting it. An attacker can manipulate session data to point the plugin toward critical system files instead of an intended upload, causing the server to delete them.

How does an attacker trigger this deletion?

An attacker triggers the bug by sending a specific request to the web server that interacts with the plugin's file-handling function. Because the vulnerability does not require authentication, the attacker does not need a user account or login privileges to execute the command. Legitimate user actions or simple site browsing do not trigger this deletion process.

Is my website at risk from this vulnerability?

If you use this plugin on a site accessible via the internet, you are at risk. Halo Surface Signal identifies this as a high-likelihood threat because the vulnerable action is reachable by anyone with web access. Sites exposed to the public are primary targets for this type of unauthenticated file removal.

Do I need to take immediate action if I run this plugin?

Yes. Start by confirming if your WordPress site has the File Upload to Order plugin installed and identify which version is currently running. If you are using a version prior to 1.1.4, prepare to coordinate with your team to address the risk, as the current configuration allows unauthorized users to potentially compromise your entire site.

References

wpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.