Junglewise Threat Intelligence

CVE-2026-6802: Easy Upload Files During Checkout unauthorized file deletion in ufdc_custom_init

CVE-2026-6802 · Severity: medium · CVSS 5.3 · Published 2026-07-10

Executive brief

The Easy Upload Files During Checkout plugin for WordPress, which allows customers to upload files during the purchase process, contains a security flaw that allows unauthorized file deletion. An attacker can remotely delete any image or document in the website's media library without needing to log in. This could lead to the loss of important website assets, product images, or customer-uploaded documents, potentially disrupting business operations and damaging the site's appearance.

Technical details

The vulnerability is classified as an authorization bypass through a user-controlled key (CWE-639) within the ufdc_custom_init() function. The plugin fails to implement security nonces, capability checks, or ownership validation when processing the 'eufdc-delete' parameter. Consequently, an unauthenticated remote attacker can send a crafted request to the site to trigger the permanent deletion of any attachment ID in the WordPress media library. This flaw affects all versions of the plugin up to and including 3.0.1. Security researchers recommend updating to a patched version if available or disabling the plugin to prevent data loss.

Affected products

  • fahadmahmood Easy Upload Files During Checkout up to, and including, 3.0.1

Timeline

  • 2026-07-10: disclosed: Vulnerability published by Wordfence and NVD.

References

Related threats