WordPress Plugin Vulnerabilities

PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

Description

The plugin does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.

Proof of Concept

Affects Plugins

Plugin icon
pepro-bacs-receipt-upload-for-woocommerce
No known fix

References

CVE
CVE-2026-14314

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Shivamani Vastrala
Submitter
Shivamani Vastrala
Verified
Yes
WPVDB ID
81ad791a-5a02-4207-9d06-9f17c45604a1

Timeline

Publicly Published
2026-07-29 (about 7 days ago)
Added
2026-07-22 (about 14 days ago)
Last Updated
2026-07-22 (about 14 days ago)

Other

Published
Title
Published
2022-07-25
Title
SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
Published
2024-12-12
Title
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin < 1.0.28 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
Published
2026-04-27
Title
Booking Package < 1.7.07 - Unauthenticated Price Manipulation via 'amount' Parameter
Published
2026-07-20
Title
FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
Published
2025-05-08
Title
WPBookit < 1.0.3 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover