Description

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-26T06:16:29.210Z",
  "pubdate": "2026-08-26T06:16:29.210Z",
  "executiveSummary": "The Order Tip for WooCommerce plugin, specifically versions prior to 1.6.0, contains a critical security vulnerability categorized as an Arbitrary File Deletion flaw.\nThis vulnerability stems from insufficient access control and a lack of input validation within the plugin's file management operations.\nSuccessful exploitation allows authenticated users with at least a Shop Manager role to delete arbitrary files on the underlying web server.\nThe risk implication is severe, as an attacker can delete sensitive configuration files, core system files, or security-related components, potentially leading to a full site compromise, service outage, or escalation to remote code execution through the deletion of security controls or by clearing the path for malicious file uploads.\nThe attack is performed via direct request to the vulnerable functionality, requiring a valid authenticated session with elevated privileges.",
  "technicalDetails": "The vulnerability resides in the backend file processing logic of the Order Tip for WooCommerce plugin. The core issue is an Improper Authorization and failure to perform Path Traversal sanitization during file deletion requests.\nSpecifically, the plugin fails to implement capability checks (e.g., current_user_can()) when handling requests directed at the file deletion module. Furthermore, the application fails to validate the target file path against a defined allowlist or base directory, enabling a Path Traversal attack.\nThe attack flow proceeds as follows: An authenticated attacker possessing at least the Shop Manager role identifies the endpoint responsible for deleting plugin-related files. By intercepting the request or crafting a malicious payload, the attacker modifies the file path parameter to target arbitrary locations outside of the intended directory, such as wp-config.php or critical .php source files.\nSince the application processes these requests with the privileges of the web server user (e.g., www-data), it proceeds to execute the filesystem deletion operation (typically using the PHP unlink() function) on the attacker-supplied target path.\nBecause the system lacks strict authorization, the plugin blindly executes the deletion command. By deleting core WordPress configuration or plugin initialization files, an attacker can effectively disable security plugins, reset site configurations, or create a state of denial of service. Furthermore, deleting critical PHP files can force the application into an insecure state, potentially allowing further exploitation through side-channel attacks or by removing secondary defensive barriers.\nThis flaw is persistent across all versions of the Order Tip for WooCommerce plugin prior to 1.6.0. It exposes the server to significant integrity loss, as there are no internal mechanisms to restrict file system access to the plugin's working directory."
}