# CVE-2026-28171: WooCommerce File Approval arbitrary file deletion

Source: https://junglewise.ai/threats/cve-2026-28171-woocommerce-file-approval-arbitrary-file-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-28171 · Severity: high · CVSS 8.6 · Published 2026-08-24

The WooCommerce File Approval plugin is a WordPress extension that manages file uploads and approvals for an e-commerce store. An unauthenticated attacker can exploit this vulnerability to delete arbitrary files from the affected website, potentially destroying critical data, configuration files, and application code, causing severe operational disruption and data loss.

Vendors: [WooCommerce](https://junglewise.ai/threats/vendors/woocommerce).

## Quick answers

**Is CVE-2026-28171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28171 being exploited in the wild.

**How severe is CVE-2026-28171?** High severity, with a CVSS score of 8.6, published 24 August 2026.

**Which products and versions are affected?** WooCommerce File Approval <=10.7.

**Is there a fix for CVE-2026-28171?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-28171 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-28171?** Check whether you run WooCommerce File Approval at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an unauthenticated arbitrary file deletion flaw in WooCommerce File Approval plugin versions 10.7 and earlier. The vulnerability stems from broken access control (OWASP A1) that allows an attacker to submit a request without valid authentication to trigger file deletion operations. The vulnerability is network-reachable and requires no prior authentication or user interaction. An attacker can delete any file accessible to the web server process, including WordPress core files, plugin files, configuration files, and user-uploaded content. As of the advisory date, no official patch is available; Patchstack has issued a mitigation rule to block exploitation attempts.

## Affected products

- WooCommerce File Approval <=10.7

## Timeline

- 2026-08-24: disclosed: Public disclosure via Patchstack
- 2026-07-11: other: Vulnerability reported by Jamaal ahmed

## References

- [https://patchstack.com/database/wordpress/plugin/woocommerce-file-approval/vulnerability/wordpress-woocommerce-file-approval-plugin-10-7-arbitrary-file-deletion-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woocommerce-file-approval/vulnerability/wordpress-woocommerce-file-approval-plugin-10-7-arbitrary-file-deletion-vulnerability?_s_id=cve)