Unknown Checkout Files Upload for WooCommerce: remote code execution

Unknown Checkout Files Upload for WooCommerce

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers…

Do this now

Upgrade Checkout Files Upload for WooCommerce to version 2.4.0 or later now.

Fix it

Upgrade to Checkout Files Upload for WooCommerce 2.4.0

First seen: 30 Oct 2026
Last update: 30 Oct 2026, 22:18 UTC
Fixed in: 2.4.0
Identifiers: CVE-2026-103688
CVSS: 9.8
Source: news
On the menu as: WordPress

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Unknown Checkout Files Upload for WooCommerce: remote code execution
Severity: critical. Patch status: patched.
Affected: Unknown Checkout Files Upload for WooCommerce
Fixed in: 2.4.0
Ids: CVE-2026-103688

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers…

## Steps
1. Search the repo, its CI and infra config for Unknown Checkout Files Upload for WooCommerce. If present, report the version in use and whether it's affected.
2. Fix by release line: Checkout Files Upload for WooCommerce: 2.4.0.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Checkout Files Upload for WooCommerce | fixed | 2.4.0 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-103688") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-103688 https://wpscan.com/vulnerability/08777aa1-6308-4e99-b2d0-5e43209aa6a6/
https://pwned.coffee/i/the-checkout-files-upload-for-woocommerce-wordpress-plug-cve-2026-103688

Timeline

30 Oct 2026, 22:18 UTC
Fix status: unknown → patched.
30 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Checkout Files Upload for WooCommerce before 2.4.0 2.4.0 CVE record (CNA) checked 30 Oct
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CISA ADP) for CVE-2026-103688
Last checked: 30 Oct 2026, 23:18 UTC

Product	Affected	Fixed in	Source
Checkout Files Upload for WooCommerce	before 2.4.0	2.4.0	CVE record (CNA) checked 30 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee