CVE-2026-103688: RCE in WooCommerce Checkout Files Upload Plugin

CVE-2026-103688 affects the Checkout Files Upload plugin for WordPress that integrates with WooCommerce. The vulnerability lies in a file type validation flaw: when the 'accepted file types' setting is left empty (a documented configuration intended to accept all files), the plugin applies no controls. This allows unauthenticated users to upload arbitrary files, including PHP scripts that are executed by the server if stored in the upload directory. The impact is remote code execution (RCE) on WooCommerce-powered e-commerce sites.

The vulnerability has a CVSS score of 9.8, classified as critical. The National Vulnerability Database (NVD) confirmed the flaw on October 28, 2026. Additionally, on October 30, signals appeared on public repository platforms indicating the existence of functional proofs of concept, confirming exploitability. No active exploitation in the wild is reported, but the availability of PoC significantly increases risk.

Organizations running WooCommerce stores must update the plugin to version 2.4.0 or later with urgency. Before updating, verify the currently installed version and test the update in staging environments to avoid compatibility issues. If immediate update is not possible, disabling the plugin is the only complete mitigation. We also recommend examining access logs and upload directory activity to detect any suspicious uploads or anomalous execution.