CVE-2026-78371

Executive Summary

CVE-2026-78371 is an authorization bypass (CWE-639) in the File Uploads Addon for WooCommerce WordPress plugin affecting all versions prior to 1.7.6. The plugin fails to verify that the requester of a customer-uploaded file is the same customer who originally uploaded it, permitting unauthenticated attackers who know or guess a file's name to retrieve other customers' uploaded files. With a CVSS base score of 5.9 and High confidentiality impact, the flaw exposes sensitive customer-submitted documents (e.g., identification, receipts, attachments) to unauthorized disclosure.

Technical Analysis

The vulnerability is a classic Insecure Direct Object Reference (IDOR) / broken object-level authorization issue, mapped to CWE-639 ("Authorization Bypass Through User-Controlled Key"). According to the NVD description, the File Uploads Addon for WooCommerce WordPress plugin before version 1.7.6 "does not verify that the person requesting a customer-uploaded file is the customer who uploaded it."

The attack surface is the plugin's file-retrieval path. When a customer uploads a file through the WooCommerce front-end, the plugin stores it and later serves it back to the customer. The flaw is that the serving/handling logic trusts the file identifier (name/path) presented by the requester rather than binding the file to the authenticated session/owner. Consequently:

• No authentication is required to trigger the flaw (PR:N, UI:N in the CVSS vector).
• The Confidentiality impact is High (C:H) because arbitrary customer files can be read.
• Attack Complexity is High (AC:H) because the attacker must know or successfully guess the file's name (a pre-condition, not a cryptographic control).
• Integrity and Availability impacts are None.

Because the NVD description does not disclose specific function names, REST routes, admin-ajax actions, or query parameters, the precise code path cannot be enumerated. What is derivable is the vulnerability class: an object-reference authorization failure in the file-serving logic where the object key is user-controllable/deterministic (the file name) and ownership is not validated against the requesting principal. File names that are guessable (sequential, timestamp-based, or trivially predictable) collapse the AC:H precondition, materially raising real-world exploitability despite the 5.9 score.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE; the attack chain below is inferred at the vulnerability-class level from the NVD description. No exploit-in-the-wild evidence is available.

1. Reconnaissance / Target Identification: The attacker identifies WordPress sites running WooCommerce with the File Uploads Addon plugin version < 1.7.6, using Shodan or internet-wide scanning against the plugin's asset paths. Because the flaw is unauthenticated, no account is needed.

2. Triggering the Flaw: The attacker requests a previously uploaded file directly through the plugin's file-retrieval mechanism, supplying a guessed or known file name/path. Because the plugin does not confirm that the requester owns the file, the request succeeds and the file is returned. The only barrier is knowledge of the file name — hence AC:H in the CVSS vector.

3. Payload / Execution (vulnerability-class level): The "payload" is simply a crafted request referencing the target file identifier. No code execution, injection string, or authentication bypass token is involved. Where file names are predictable (sequential numbering, common naming conventions, or disclosed via other means), enumeration succeeds at scale.

4. Post-Exploitation Impact: Successful retrieval yields unauthorized access to other customers' uploaded files. Depending on what customers uploaded (identity documents, invoices, receipts, contracts, support attachments), this constitutes a privacy/confidentiality breach. Disclosed content can enable secondary attacks including social engineering, account takeover enablers, and regulatory exposure. No integrity or availability effects are described.

Impact Assessment

• Base score: 5.9 (Medium) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
• Confidentiality: High — arbitrary customer-uploaded files may be disclosed.
• Integrity/Availability: None per vector.
• Attack vector: Network, unauthenticated, no user interaction.
• Blast radius: Every WooCommerce deployment using the affected plugin version where customer uploads exist. Multi-tenant/stores handling sensitive customer documents face the highest business risk (GDPR/CCPA/privacy liability, brand damage, downstream fraud).
• The AC:H rating is a mitigating factor only while file names remain unpredictable; stores using predictable naming conventions or exposing file identifiers elsewhere can experience near-automated mass disclosure.
• CISA KEV: NO. EPSS: Not yet scored by FIRST.org. No public exploit or Nuclei template.

Detection Guidance

Sigma Rule

title: Potential WooCommerce File Uploads Addon IDOR File Retrieval
id: 8f4c1b2e-7a3d-4c56-9e21-7d0a1f9b6c42
status: experimental
description: Detects unauthenticated or cross-user retrieval of customer-uploaded files from the WooCommerce File Uploads Addon (CVE-2026-78371).
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-stem|contains:
      - "/wp-content/uploads/"
  selection_plugin:
    cs-uri-query|contains:
      - "file-uploads"
      - "woocommerce"
  selection_status:
    sc-status: 200
  condition: selection_path and selection_plugin and selection_status
falsepositives:
  - Legitimate customers downloading their own uploads
  - Search engine crawlers indexing public assets
level: medium
tags:
  - attack.t1190
  - cwe.639

YARA Rule

rule CVE_2026_78371_WooCommerce_FileUploads_IDOR
{
    meta:
        description = "Detects requests/log artifacts referencing the vulnerable WooCommerce File Uploads Addon file-retrieval pattern (CVE-2026-78371)"
        author = "Threat Intelligence"
        reference = "CVE-2026-78371"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $p1 = "file-uploads" nocase
        $p2 = "/wp-content/uploads/" nocase
        $p3 = "woocommerce" nocase
        $p4 = "plugin" nocase
    condition:
        ($p1 and $p2) or ($p2 and $p3 and $p4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78371 WooCommerce File Uploads Addon Unauthenticated File Retrieval Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-content/uploads/"; nocase; http.uri; content:"file-uploads"; nocase; classtype:attempted-recon; reference:cve,2026-78371; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-78371; sid:202678371; rev:1;)

Elastic Detection

sequence by source.ip
  [ network where http.request.method == "GET"
      and stringContains(http.request.uri.path, "/wp-content/uploads/")
      and stringContains(http.request.uri.query, "file-uploads") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=access_common
| search uri_path="*/wp-content/uploads/*" (uri_query="*file-uploads*" OR uri_query="*woocommerce*")
| stats count values(uri_path) as paths values(status) as statuses by clientip
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,woocommerce,cve-2026-78371,">
  <rule id="100783" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <match>/wp-content/uploads/</match>
    <regex type="pcre2">file-uploads|woocommerce</regex>
    <description>CVE-2026-78371: Possible unauthenticated access to customer-uploaded file in WooCommerce File Uploads Addon</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Upgrade the File Uploads Addon for WooCommerce to version 1.7.6 or later; this is the vendor-identified fix threshold per the NVD description. If no verified patch is available from tracked sources, treat the environment as unpatched.
   • Where possible, disable or remove the plugin until a verified fix is available.
   • Restrict direct HTTP access to the directory where customer uploads are stored (e.g., deny direct web access and serve files only through authorization-checked logic).
   • Treat all stored filenames as sensitive; rotate/rename uploaded files to unpredictable values to raise the guessing barrier.
   • Add WAF rules blocking direct requests to upload paths that lack an authenticated, owner-bound session.

2. Patch/Upgrade Steps:

   • Confirm the installed plugin version from the WordPress admin or via WP-CLI.
   • Back up the site and database before upgrading.
   • Apply the 1.7.6 (or later) release once available and independently verified; re-test file access controls post-upgrade to confirm ownership checks are enforced.

3. Long-Term Hardening:

   • Enforce server-side object-level authorization on every file-retrieval endpoint (bind file to authenticated owner).
   • Adopt non-sequential, high-entropy file identifiers instead of predictable names.
   • Centralize upload handling with an authorization middleware that validates ownership on each request.
   • Monitor plugin advisories continuously; maintain an SBOM/inventory of WordPress plugins.
   • Implement least-privilege file storage permissions and regular access-log review for anomalous retrieval patterns.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78371
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security Advisories (WPScan/WordPress.org): https://wpscan.com/
• CISA KEV Catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template was observed for CVE-2026-78371. No threat actor campaign or in-the-wild exploitation evidence is available.