Description

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-24T12:16:50.970Z",
  "pubdate": "2026-08-24T12:16:50.970Z",
  "executiveSummary": "An unauthenticated arbitrary file deletion vulnerability has been identified in the WooCommerce File Approval plugin affecting versions 10.7 and below.\nThis security flaw permits unauthenticated remote attackers to delete arbitrary files on the underlying filesystem of the affected WordPress installation, posing severe risks to system integrity and availability.\nThe vulnerability stems from improper handling of user-supplied input within the file management or approval logic, allowing malicious actors to target critical system files, including configuration files such as wp-config.php, theme files, core WordPress components, or plugins.\nSuccessful exploitation requires network access to the target WordPress site without requiring any prior authentication or privileged access roles.\nThe risk implications are critical, as arbitrary file deletion can lead to immediate denial of service (DoS), application downtime, or potentially facilitate further exploitation vectors such as privilege escalation or site takeover if sensitive core files are systematically removed.\nAdministrators running vulnerable versions of the WooCommerce File Approval plugin are exposed to complete state manipulation of the filesystem layer accessible by the web server user.",
  "technicalDetails": "The vulnerability resides in the WooCommerce File Approval plugin for WordPress, specifically affecting all versions up to and including version 10.7.\nThe root cause of the security defect is insufficient input validation, inadequate sanitization, and a lack of proper authorization checks on parameters handling file paths or file identifiers during the deletion routine within the vulnerable component.\nBecause the functionality lacks proper access control validation, unauthenticated remote attackers can directly interact with the vulnerable endpoint via HTTP requests.\nThe attack flow proceeds as follows: an attacker sends a crafted HTTP request targeting the vulnerable file handling functionality exposed by the plugin.\nDue to the absence of authentication requirements and session validation, the application processes the incoming request without verifying whether the requesting entity possesses administrative privileges or ownership of the targeted resource.\nThe payload supplied within the request specifies the target file path to be deleted.\nThe vulnerable code securely or insecurely passes this path to filesystem manipulation functions without adequate path traversal restrictions or boundary checks, resulting in the removal of the specified file from the server disk.\nDepending on the permissions of the web server user (e.g., www-data), the attacker can delete any file readable or writable by that user account.\nPost-exploitation impact includes the permanent loss of critical application data, corruption of the WordPress installation leading to denial of service, deletion of security plugins, or removal of the wp-config.php file which forces a reinstallation state and potentially exposes the site to subsequent installation-based attacks.\nNetwork exposure is absolute for any publicly accessible WordPress instance utilizing the affected plugin versions."
}