CVE-2026-77693

Name of the Vulnerable Software and Affected Versions Order Tip for WooCommerce versions prior to 1.6.0

Description Insufficient capability checks and a lack of path restriction in the delete exported csv file ajax function allow users with the Shop Manager role or higher to delete arbitrary files on the server. This flaw could potentially lead to a complete site takeover.

Recommendations Update Order Tip for WooCommerce to version 1.6.0 or later. As a temporary mitigation, restrict access to the delete exported csv file ajax function for users with the Shop Manager role.