Checkout File Uploads on WooCommerce: Update Before November 26

On October 26, 2026, WPScan published a verified report for CVE-2026-103688. It affects Checkout Files Upload for WooCommerce, a plugin by WP Wham. WordPress.org says the plugin lets customers upload files on or after WooCommerce checkout, and the listing shows 7,000+ active installations. If your store asks shoppers to attach a file when they order, this one is worth a quiet look.

The detail that matters is a single setting. If you are still on a version before 2.4.0, here is what WPScan describes. The plugin does not validate uploaded file types when the accepted file types setting is left empty. That empty setting is documented as the way to accept every kind of file. A person who is not logged in can upload any file, including a PHP file. PHP is the programming language WordPress runs on. When a server runs PHP from the uploads folder, that file can lead to remote code execution, which means the upload runs as a program on the site. I can look over the public side of the store with a security scan: Able OWASP is $349 once, and Able PCI is $149 a month. See security scans or write me at greg@ableadmins.com.

What the report actually says

WPScan lists the issue as verified, credits Josef Azizov (Spoofable), and says it is fixed in version 2.4.0. It names the plugin checkout-files-upload-woocommerce. Patchstack published its entry on October 28, 2026. It lists versions before 2.4.0 as vulnerable, calls the issue an unauthenticated arbitrary file upload, and advises updating to version 2.4.0 or later. Unauthenticated means a person can do this without an account. Arbitrary file upload means any file type can go through, including types you never meant to allow.

The WordPress.org changelog for 2.4.0 is dated October 20, 2026. Leaving the accepted file types setting blank no longer means all files are allowed. Unless you enter other types yourself, only certain file types WordPress already allows are accepted. WPScan will display its proof of concept on November 26, 2026, so owners have time to update. A proof of concept is a short sample that shows the issue working. The full notes are on WPScan, the WordPress.org plugin page, and Patchstack.

A calm way to check your store

Open your WordPress dashboard and go to Plugins. Find Checkout Files Upload for WooCommerce and read the version beside it. If that number is under 2.4.0, update to 2.4.0 or later. I take a backup of the files and the database before I update a plugin that sits on checkout, so the store can be restored if the update misbehaves.

After the update, open the accepted file types setting. Enter the extensions customers already send with their orders. With 2.4.0, you choose those types by typing them in. If you need something less common, add it yourself, place a small test order, and confirm a normal file still goes through.

Confirm the installed version is 2.4.0 or later.
Fill in the accepted file types your customers send.
Place a test order and upload a file a customer would actually send.
Look through recent uploads for names you do not recognize, including files that end in .php.
If a file looks out of place, leave it where it is and write down the name and the date.

November 26 is the date WPScan gave people to update before it displays a proof of concept. If a web person looks after your plugins, send them the plugin name and version 2.4.0, and ask them to check the accepted file types field once the update is in. If you look after the site yourself, the Plugins screen is the place to start.

Version numbers and the full CVE entry stay on the WPScan page. For the store, the useful outcome is a current plugin and a file-type list you chose.

How Able can help

I do this work myself. Once the plugin is updated, a scan is a clear look at the pages a visitor can open. The Able OWASP scan is $349 once. You get an OWASP ZAP report for one public site, plus one recheck within 30 days. ZAP is a scanner that walks the public site and writes down what it finds. Able PCI is $149 a month for a quarterly external scan. Email greg@ableadmins.com or call (832) 977-1356 and I will help you choose a time.

Sources

If you would like me to look at the public side of your store, see the security scans or write me at greg@ableadmins.com.