CVE-2026-13607

{
  "etk_id": "ETK-2026-627",
  "cve_id": "CVE-2026-13607",
  "display_id": "CVE-2026-13607",
  "ghsa_id": "GHSA-8493-3qrc-44fv",
  "euvd_id": "EUVD-2026-92261",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper upload access control in File Uploads Addon for WooCommerce",
  "summary": "File Uploads Addon for WooCommerce through 1.7.6 may expose customer-uploaded files through its web-served upload storage. An unauthenticated party may obtain a file by knowing or predicting its name, bypassing the intended authenticated download path.",
  "mitigation": "Block direct web access to the directory containing this plugin's customer uploads and serve downloads only through authenticated application handling. Move uploads outside the web root where feasible, and monitor for a vendor update.",
  "vendor": null,
  "product": "File Uploads Addon for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.7.2, <= 1.7.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "File Uploads Addon for WooCommerce",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 5.9,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0029,
  "epss_percentile": 0.2022,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 55.86189855,
  "t0_at": "2026-10-05T06:00:23.632000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T06:00:23.632000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T06:00:23.632000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13607"
    }
  }
}