PT-2026-89761 · Mulika · Mipl Grouped Checkout Fields For Woocommerce. Customize & Organize Checkout Fields.

Farrukh Ziyaev

·

CVE-2026-8778

·

Published

2026-09-11

·

Updated

2026-09-11

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mipl wc upload file function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Fix

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-8778

Affected Products

Mipl Grouped Checkout Fields For Woocommerce. Customize & Organize Checkout Fields.