CVE-2026-107594

Executive Summary

CVE-2026-107594 is a critical path traversal / external control of file name or path vulnerability (CWE-73) in the File Upload to Order WordPress plugin affecting all versions before 1.1.4. An unauthenticated attacker can supply attacker-controlled session data that is used as a file path in a deletion action, allowing arbitrary file deletion on the web server. Because the action is reachable without authentication and the path is not validated or confined, successful exploitation can remove critical files and result in full site compromise.

Technical Analysis

The vulnerability resides in the File Upload to Order WordPress plugin. According to the NVD description, the plugin "does not validate or confine a file path taken from attacker-controlled session data before deleting the file." This corresponds to CWE-73 (External Control of File Name or Path), a class of weakness in which user-supplied or externally influenced data is used to construct a filesystem path without adequate validation.

Two distinct weaknesses combine here:

1. Unvalidated path from session data — The file path used by the deletion routine originates from session data that the attacker can control. Because there is no normalization, allow-listing, or confinement to an intended upload directory before the delete operation, the attacker can point the deletion routine at files outside the legitimate scope, including critical application or server files.

2. Unauthenticated reachability — The NVD description explicitly states that "the action that performs the deletion is reachable by unauthenticated users." No authentication or capability check is enforced on the action that triggers the deletion. This means an anonymous remote user can invoke the vulnerable code path directly.

The combination of an externally controlled file path and anonymous reachability produces the most severe outcome: arbitrary file deletion on the server. The NVD description further notes the impact can include deletion of "files whose removal leads to full site compromise," indicating that files essential to the integrity or operation of the site can be targeted.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H, scoring 10.0. Notably:

• AV:N / AC:L / PR:N / UI:N — Network-exploitable, low complexity, no privileges, no user interaction. The vulnerability can be triggered remotely by an anonymous attacker with minimal effort.
• S:C (Scope Changed) — The impact crosses a security boundary; compromise of the vulnerable component can affect resources beyond it, consistent with arbitrary file deletion affecting the wider host/site.
• C:N / I:H / A:H — No direct confidentiality impact is asserted, but there is high integrity impact and high availability impact, consistent with the ability to delete arbitrary files.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE at the time of writing.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description; no specific function names, endpoints, file paths, or parameters are provided in the source data and none should be assumed.

1. Reconnaissance / target identification — An attacker identifies internet-facing WordPress sites running the File Upload to Order plugin at a version before 1.1.4. Plugin detection is typically possible through publicly accessible plugin assets and directory structure.

2. Triggering the flaw class — The attacker makes a request that reaches the deletion action, which the NVD description states is reachable by unauthenticated users. Because the file path used by the deletion is taken from session data the attacker can control, the attacker influences that session-derived value so that it references a target file. No validation or confinement is applied to the path before the delete operation.

3. Execution method — The request causes the plugin to delete the file named by the attacker-influenced, session-derived path. Since the path is neither validated nor confined, the deletion is not limited to legitimate upload locations.

4. Post-exploitation impact — The attacker can delete arbitrary files on the server, including files "whose removal leads to full site compromise." Deleting critical files can render the site inoperable (availability impact) or enable further compromise (integrity impact), consistent with the CVSS scores.

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-73) and the NVD description.

Impact Assessment

• Business impact: Arbitrary file deletion on a public-facing web server can take a site offline, corrupt application state, and remove files necessary for the site's operation. Because the description states removal of certain files "leads to full site compromise," the blast radius may extend beyond a single plugin to the entire WordPress installation and potentially the host.
• Affected systems: Any WordPress site running the File Upload to Order plugin at a version before 1.1.4.
• Exploitability: With AV:N/AC:L/PR:N/UI:N, the vulnerability is trivially reachable by an anonymous remote attacker with no required user interaction, making it attractive for opportunistic mass scanning.
• CVSS interpretation: The 10.0 score reflects network exploitability, no privileges or interaction required, scope change, and high integrity and availability impact.

Detection Guidance

Sigma Rule

title: Potential File Upload to Order Arbitrary File Deletion (CVE-2026-107594)
id: 7c1e6a2b-3f4d-4a8e-9b2c-5d6f7a8b9c0d
status: experimental
description: Detects HTTP requests targeting the File Upload to Order WordPress plugin that may attempt to trigger an unauthenticated arbitrary file deletion action.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107594
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-query|contains:
      - '/wp-content/plugins/file-upload-to-order/'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  condition: selection_plugin and selection_method
falsepositives:
  - Legitimate plugin traffic
level: high

YARA Rule

rule CVE_2026_107594_File_Upload_To_Order
{
    meta:
        description = "Detects references to the File Upload to Order WordPress plugin within web content or logs related to CVE-2026-107594"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107594"
        date = "2026-01-01"
    strings:
        $plugin = "file-upload-to-order" ascii nocase
        $wp = "wp-content/plugins" ascii nocase
    condition:
        $plugin and $wp
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107594 File Upload to Order WordPress Plugin Unauthenticated Arbitrary File Deletion Attempt"; flow:established,to_server; http.uri; content:"/wp-content/plugins/file-upload-to-order/"; http.method; content:"GET"; sid:2026107594; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and url.path contains "/wp-content/plugins/file-upload-to-order/" ]

Splunk SPL Query

index=web_logs
| search uri="*wp-content/plugins/file-upload-to-order*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,">
  <rule id="100594" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/wp-content/plugins/file-upload-to-order/</url>
    <description>CVE-2026-107594: Possible exploitation of File Upload to Order plugin arbitrary file deletion</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • If the File Upload to Order plugin is not required, deactivate and remove it entirely.
   • If it must remain, restrict access to the plugin's functionality using a Web Application Firewall (WAF) or reverse-proxy rules that block unauthenticated requests to plugin actions.
   • Apply strict server-side file permissions so the web process cannot delete arbitrary files outside intended upload directories.

2. Patch / upgrade steps:

   • The NVD description states the issue is addressed in File Upload to Order version 1.1.4. Update to 1.1.4 or later as soon as a verified vendor release is available, and confirm the source through official WordPress plugin channels. Because patch confidence is currently 0/4 with no tracked patch evidence, validate any available update's authenticity and changelog before relying on it.

3. Long-term hardening:

   • Enforce path validation and confinement for any file operations, canonicalizing and restricting targets to an intended directory.
   • Require authentication and capability checks on all file-modifying actions.
   • Avoid deriving filesystem paths from client-controllable session data.
   • Continuously inventory WordPress plugins and remove unused components to reduce attack surface.

References

• NVD — CVE-2026-107594: https://nvd.nist.gov/vuln/detail/CVE-2026-107594
• MITRE CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security guidance: https://wordpress.org/plugins/
• CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-107594 at the time of this report.