CVE-2026-16054

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for WooCommerce versions prior to 1.1.8

Description An issue exists where unauthenticated users can obtain a valid nonce, which is the sole security control for the file-deletion routine. This allows anonymous attackers to delete files stored in the upload directory, leading to the irreversible destruction of pending order attachments from customers.

Recommendations Update Drag and Drop Multiple File Upload for WooCommerce to version 1.1.8 or later.