CVE-2026-14313

Name of the Vulnerable Software and Affected Versions PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1

Description The plugin is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) write, which occurs when an application provides direct access to objects based on user-supplied input without proper authorization. This allows an unauthenticated attacker to perform order receipt tampering. The issue requires WooCommerce to be installed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.