CVE-2026-6802

Name of the Vulnerable Software and Affected Versions Easy Upload Files During Checkout versions prior to 3.0.2

Description The Easy Upload Files During Checkout plugin for WordPress allows unauthorized access due to missing authorization checks in the ufdc custom init() function. The function processes the eufdc-delete parameter without performing nonce verification, capability checks, or validating attachment ownership. This flaw enables unauthenticated attackers to permanently delete arbitrary media library attachments from the site.

Recommendations Update the plugin to a version newer than 3.0.1. As a temporary mitigation, restrict access to the ufdc custom init() function or avoid using the eufdc-delete parameter until the update is applied.