A WordPress plugin that lets shoppers attach files during checkout has an unauthenticated file upload flaw rated 10 out of 10. The fix shipped on 28 October and the update takes a minute.
What happened
Patchstack published CVE-2026-103688 for Checkout Files Upload for WooCommerce on 28 October 2026. Every version below 2.4.0 is affected, and 2.4.0 is the fixed release.
The classification is arbitrary file upload, reachable without any authentication and without a valid account on the store. Patchstack scores it CVSS 10, flags it high priority, and states that flaws in this class are the ones mass-exploitation campaigns sweep across thousands of sites at once. The researcher credited is Josef Azizov of Spoofable.
As of publication there is no report of exploitation in the wild. That is not reassurance: an unauthenticated upload endpoint on a public storefront is found by scanners within days, not months.
Who is affected
Any WordPress and WooCommerce store with this plugin active on a version below 2.4.0.
- Stores that take custom orders, artwork, proof files or documents from customers at checkout
- Sites on shared hosting, where an uploaded file typically lands in a web-reachable directory
- Sites that have not enabled automatic plugin updates and have no maintenance window this week
- Agencies and MSPs running WooCommerce for multiple clients, where one forgotten site is enough
What to do now
Update Checkout Files Upload for WooCommerce to 2.4.0 or later today, then check the uploads directory for files you did not expect.
- Confirm the plugin is actually installed before you relax. Search the plugin list across every site you maintain, not just the ones you remember
- After updating, review wp-content/uploads for recently modified PHP files and remove anything executable that should not be there
- Compare administrator accounts against your known list and remove anything unfamiliar
- Reset WordPress salts and any store administrator passwords if you find a suspicious file
- If the plugin cannot be updated immediately, deactivate it until it can be
What this means for South African businesses
Small South African stores add plugins for one feature and forget them for years, and an upload form on a checkout page is exactly the kind of feature that gets installed and never reviewed. The exposure here is not subtle: no credentials are needed, so a bot can reach the endpoint on the day it learns the path. If you run WooCommerce, this is a ten-minute fix that is worth doing before the scanners catch up.
Full advisory and version detail are on Patchstack's database entry.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.