Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter
medium
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1. This is due to missing authorization checks in the ufdc_custom_init() function, which processes the 'eufdc-delete' parameter without any nonce verification, capability check, or a...
- CVSS:
- 5.3
- Affected:
- up to 3.0.1
- Fixed in:
- 3.0.2
- Disclosed:
- Jul 9, 2026
CVE-2026-6802 on NVD →
Easy Upload Files During Checkout <= 3.0.0 - Missing Authorization
medium
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 3.0.0
- Fixed in:
- 3.0.1
- Disclosed:
- Dec 31, 2025
CVE-2025-62078 on NVD →
Easy Upload Files During Checkout <= 2.9.8 - Unauthenticated Arbitrary JavaScript File Upload
critical
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions up to, and including, 2.9.8. This makes it possible for unauthenticated attackers to upload arbitrary JavaScript files...
- CVSS:
- 9.8
- Affected:
- up to 2.9.8
- Fixed in:
- 2.9.9
- Disclosed:
- Nov 3, 2025
CVE-2025-12682 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database