CVE-2026-93550

Name of the Vulnerable Software and Affected Versions Veeqo for WooCommerce versions prior to 2.2.9

Description The plugin fails to restrict access to its remote bridge-installation process and does not validate the provided URL before downloading and extracting content. This allows users with Subscriber-level access and above to trigger the download and extraction of an attacker-controlled archive containing arbitrary PHP files into the WordPress root via the start veeqo connection process function.

Recommendations Update Veeqo for WooCommerce to a version newer than 2.2.8. As a temporary workaround, restrict access to the start veeqo connection process function to prevent unauthorized users from triggering the installation process.