CVE-2026-13607

Executive Summary

CVE-2026-13607 is an improper access control vulnerability (CWE-284) in the File Uploads Addon for WooCommerce WordPress plugin, affecting all versions through 1.7.6. The plugin stores customer-uploaded files in a publicly web-accessible uploads directory, and the access restriction it attempts to generate is ineffective, allowing an unauthenticated attacker who knows or guesses a file name to retrieve customer-uploaded files directly, bypassing the plugin's authenticated download mechanism. This exposes potentially sensitive customer-uploaded content (e.g., documents, images, and other order-related files) to any remote actor with network access to the affected site; no authentication or user interaction is required, though exploitation depends on the attacker's ability to know or guess the target file's name.

Technical Analysis

The File Uploads Addon for WooCommerce WordPress plugin through version 1.7.6 implements a file upload feature that permits customers to attach files (for example, to orders or product interactions). Uploaded files are written to the WordPress uploads directory, which by design is publicly web-accessible under a site's document root (typically wp-content/uploads/). While the plugin provides an "authenticated download mechanism" as the intended path for retrieving these files, the underlying storage location remains directly reachable over HTTP. The plugin attempts to generate some form of access restriction on this directory or on the stored files, but per the NVD description, that restriction is "ineffective."

This is a classic broken access control / improper access control condition (CWE-284). The security control relies on obscurity and/or a generated restriction that does not actually prevent direct retrieval. Because the files reside in a publicly web-accessible uploads directory, an attacker does not need to authenticate, interact with the plugin's intended download flow, or possess any customer account. The only barrier is knowledge of the file name (path). WordPress uploads are frequently organized by predictable date-based directory structures and may retain the original file name supplied at upload time, which substantially lowers the guessing barrier. When a file name is known (for example, leaked through order confirmation emails, front-end rendering, predictable naming, or sharing of links) or guessable (common words, sequential or date-based naming), the file can be fetched directly via a standard HTTP GET request to its public URL.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N reflects the following: network attack vector (AV:N), high attack complexity (AC:H — because the attacker must know or successfully guess the exact file name/path), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H — exposure of customer-uploaded files), and no integrity (I:N) or availability (A:N) impact. The base score is 5.9 (Medium). The confidentiality impact is rated High because the exposed files are customer-uploaded content that may contain sensitive personal or business information; the High complexity and absence of integrity/availability effects keep the overall score in the Medium range.

Notably, the description does not disclose the specific server configuration directive (e.g., .htaccess rule), file-naming scheme, or the precise implementation of the ineffective restriction. No specific function names, parameter names, or endpoint paths are provided in the available data. Analysts should therefore treat the mechanism at the vulnerability-class level: publicly stored files whose intended access control fails to actually gate retrieval.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-13607. The attack chain below is inferred strictly from the vulnerability class (improper access control over publicly stored files) and the NVD description. No vendor advisory or in-the-wild exploitation evidence is currently available.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running WooCommerce with the File Uploads Addon for WooCommerce plugin (versions through 1.7.6). This can be done via fingerprinting plugin assets loaded in page HTML or referenced by static resources (e.g., assets under the plugin's directory), or by scanning for known WooCommerce/storefront indicators. Because the plugin has no distinct network service, identification is application-layer (HTTP) only.

2. Triggering the flaw class. The flaw is not "triggered" by a crafted request in the traditional sense; it is a persistent misconfiguration/design weakness. Uploaded customer files are stored in the publicly web-accessible WordPress uploads directory. The intended authenticated download mechanism is bypassed entirely because the attacker requests the file's direct public path rather than the plugin's download handler. The plugin's generated access restriction is ineffective, so no auth challenge or denial is enforced on the direct path.

3. Retrieval method. The attacker issues a standard unauthenticated HTTP GET request to the direct URL of a stored uploaded file under the public uploads directory. Success depends on knowing or guessing the file's name/path. Where upload paths follow predictable date-based folder conventions and/or preserve predictable or original file names, guessing is feasible. No payload execution occurs — this is a read/exfiltration primitive, not code execution. There is no privilege escalation step and no user interaction required.

4. Post-exploitation impact. Successful retrieval yields the contents of customer-uploaded files, which may include invoices, identity documents, order attachments, or other sensitive materials. The attacker gains confidentiality exposure without any integrity or availability impact, can enumerate additional predictable file names to harvest more documents, and may use exposed content for fraud, social engineering, doxxing, or business intelligence. Because the plugin provides no logging of direct file access (files are served by the web server, not the plugin), the retrieval may leave minimal application-level traces.

Impact Assessment

Successful exploitation results in unauthorized disclosure of customer-uploaded files. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The relevant subscores:

• Attack Vector: Network — exploitation is possible remotely over HTTP(S).
• Attack Complexity: High — the attacker must know or successfully guess the file name/path.
• Privileges Required: None — the authenticated download mechanism is bypassed; no account or login is needed.
• User Interaction: None — no victim action is required.
• Scope: Unchanged — impact is confined to the affected site's stored data.
• Confidentiality: High — customer-uploaded files may contain sensitive personal or commercial information.
• Integrity: None, Availability: None.

Affected systems are any WordPress/WooCommerce deployments with the File Uploads Addon for WooCommerce plugin at version 1.7.6 or earlier. The blast radius is scoped to the confidentiality of files uploaded through the plugin by customers. Because there is no public PoC, no Nuclei template, no EPSS score (not yet scored by FIRST.org), and no CISA KEV listing, active exploitation is not currently evidenced. However, the low number of prerequisites (no auth, no interaction) combined with predictable upload directory conventions means that any site exposing this plugin and its uploads directory should be considered at risk of automated file-name guessing and harvesting.

Detection Guidance

Sigma Rule

title: Suspicious Direct Access to File Uploads Addon for WooCommerce Uploaded Files
id: 8f2a1c44-1360-7a6b-9e11-wooc13607a
status: experimental
description: Detects direct HTTP GET requests to customer-uploaded files stored in the public WordPress uploads directory, bypassing the File Uploads Addon for WooCommerce authenticated download mechanism (CVE-2026-13607).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13607
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wp-content/uploads/'
  selection_plugin:
    cs-uri-stem|contains:
      - 'file-uploads'
      - 'woocommerce'
  filter_legit:
    cs-uri-stem|endswith:
      - '.css'
      - '.js'
      - '.jpg'
      - '.jpeg'
      - '.png'
      - '.gif'
      - '.webp'
  condition: selection_path and selection_plugin and not filter_legit
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - sc-status
falsepositives:
  - Legitimate storefront image/document delivery from the uploads directory
  - CDN or caching layer fetch requests
level: medium

YARA Rule

rule CVE_2026_13607_WooCommerce_FileUploads_Addon
{
    meta:
        description = "Detects File Uploads Addon for WooCommerce plugin artifacts (through 1.7.6) associated with CVE-2026-13607."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13607"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $plugin_dir1 = "file-uploads-addon-for-woocommerce" ascii wide nocase
        $plugin_dir2 = "file-uploads-addon" ascii wide nocase
        $plugin_header = "Plugin Name: File Uploads Addon for WooCommerce" ascii wide nocase
        $readme = "File Uploads Addon for WooCommerce" ascii wide nocase
        $wc_ref = "woocommerce" ascii wide nocase

    condition:
        filesize < 5MB and
        ( 1 of ($plugin_dir*) or $plugin_header or $readme ) and $wc_ref
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-13607 File Uploads Addon for WooCommerce Direct Uploaded File Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-content/uploads/"; content:"file-uploads"; nocase; http.uri; pcre:"/\.(pdf|docx?|xlsx?|csv|zip|png|jpe?g)$/i"; classtype:attempted-recon; reference:cve,2026-13607; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-13607; metadata:affected_product WordPress, attack_target Web_Server, created_at 2026_01_01, deployment Perimeter, signature_severity Minor, tag CVE_2026_13607; sid:202613607; rev:1;)

Note: file-uploads and WordPress upload path fragments are used as heuristic request markers because no exact endpoint is specified in the available vulnerability data; tune the PCRE to observed deployment paths.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET"
      and http.request.uri : "*wp-content/uploads*"
      and http.request.uri : "*file-uploads*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_path = lower(uri)
| where (like(uri_path, "%/wp-content/uploads/%") AND like(uri_path, "%file-uploads%"))
| where NOT (like(uri_path, "%.css") OR like(uri_path, "%.js") OR like(uri_path, "%.png") OR like(uri_path, "%.jpg") OR like(uri_path, "%.jpeg") OR like(uri_path, "%.gif") OR like(uri_path, "%.webp"))
| stats count values(uri) as requested_files values(status) as response_codes by clientip, host
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,woocommerce,CVE-2026-13607,">
  <rule id="202613607" level="8">
    <if_sid>31100</if_sid>
    <field name="url">/wp-content/uploads/</field>
    <field name="url">file-uploads</field>
    <description>CVE-2026-13607: Possible unauthorized direct access to File Uploads Addon for WooCommerce customer-uploaded files.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_13607,access_control_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or patch reference is currently available for CVE-2026-13607.

1. Immediate mitigations:

• Move or block direct web access to customer-uploaded files. Where the hosting stack allows, deny direct HTTP access to the specific uploads subdirectory used by the File Uploads Addon for WooCommerce (for example, via web-server deny rules or directory-level access controls), so files can only be served through the plugin's authenticated download mechanism.
• If file storage location is configurable, relocate uploaded files outside the web root. If not configurable, treat this as a residual risk and apply compensating controls.
• Consider disabling the plugin if its upload feature is not operationally required, until a fix is available.
• Reduce guessability: avoid predictable/original file names if any naming control is exposed to administrators, and avoid referencing raw upload URLs in customer-facing emails or pages.

2. Patch/upgrade steps:

• No patched version exists as of this report. Monitor the plugin vendor and the WordPress plugin repository for an updated release that addresses CVE-2026-13607, and upgrade immediately once available. Verify the fix actually restricts direct access (e.g., by testing that a known uploaded file returns 403/404 on the direct path).

3. Long-term hardening:

• Enforce server-side authorization on every file retrieval rather than relying on obscurity or ineffective generated restrictions.
• Store user-supplied files outside the public document root, serving them via a controlled handler that validates the requester's authorization.
• Adopt a layered web application firewall (WAF) ruleset to detect and throttle mass direct access to uploads paths.
• Maintain a plugin inventory and vulnerability-monitoring process to catch unpatched components like this quickly.
• Because EPSS is not yet scored and no KEV/PoC evidence exists, prioritize based on exposure of actual customer-uploaded content on internet-facing storefronts.

References

• NVD — CVE-2026-13607: https://nvd.nist.gov/vuln/detail/CVE-2026-13607
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• File Uploads Addon for WooCommerce (WordPress plugin directory) — monitor for security update
• WordPress Hardening — Protect Upload Files: https://developer.wordpress.org/advanced-administration/security/hardening/
• FIRST.org EPSS (score not yet available for CVE-2026-13607): https://www.first.org/epss/

No public Proof-of-Concept, Nuclei template, or exploit code is currently known. CVE-2026-13607 is not listed in CISA KEV, and no threat actor campaign or in-the-wild exploitation evidence has been observed at the time of writing.