Executive brief
The Order Tip for WooCommerce plugin allows authenticated users with Shop Manager role to delete arbitrary files from the server without proper authorization checks. An attacker with a Shop Manager account can delete critical files like wp-config.php, causing the site to enter installation mode or become completely inaccessible, leading to a complete site takeover.
Technical details
The plugin's delete_exported_csv_file_ajax AJAX handler fails to verify user capabilities (current_user_can) and applies only basic text sanitization to the filePath parameter without restricting file paths. This allows Shop Manager users to craft AJAX requests to delete any server-accessible file, including WordPress core files and configuration files. The vulnerability requires authentication as a Shop Manager or higher role and knowledge of a valid nonce value. An attacker can leverage this to delete wp-config.php to force the site into setup mode, or remove plugins/themes to cause denial of service or facilitate further compromise. A patch is available in version 1.6.0.
Affected products
- Order Tip for WooCommerce Order Tip for WooCommerce before 1.6.0
Timeline
- 2026-08-24: disclosed
- 2026-08-26: patched: Version 1.6.0 released