WordPress Plugin Vulnerabilities

Booster for WooCommerce < 8.0.2 - Customer+ Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
woocommerce-jetpack
Fixed in 8.0.2

References

CVE
CVE-2026-56027
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/4d260dd3-0006-4a2d-b7ca-c484e4c9ebb5

Miscellaneous

Original Researcher
Jakub Herman
Verified
Yes
WPVDB ID
6dea8543-72e8-4524-8071-70ed17dc66bf

Timeline

Publicly Published
2026-06-23 (about 3 months ago)
Added
2026-07-02 (about 3 months ago)
Last Updated
2026-10-12 (about 4 days ago)

Other

Published
Title
Published
2025-03-28
Title
SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload
Published
2014-08-01
Title
Switchblade 1.3 - Arbitrary File Upload
Published
2024-11-08
Title
Forms < 2.8.1 - Unauthenticated Arbitrary File Upload
Published
2024-01-08
Title
Barcode Scanner with Inventory & Order Manager < 1.5.2 - Unauthenticated Arbitrary File Upload via uploadFile
Published
2014-08-01
Title
Clockstone <= 1.2 - Arbitrary File Upload