← Back to the live CVE advisory feed

CVE-2026-78371: File Uploads Addon for WooCommerce

Severity

5.9 (MEDIUM)

Vendor

ADOBE

Affected versions

1.7.2 through before 1.7.6

Fixed version

1.7.6

Patch status

Patched

Published

2026-10-05T06:16:58.830

Modified

2026-10-05T11:17:00.400

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

View the official NVD record for CVE-2026-78371

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.