CVE-2026-13607: CWE-284 Improper Access Control in File Uploads Addon for WooCommerce

CVE-2026-13607 describes an improper access control vulnerability (CWE-284) in the File Uploads Addon for WooCommerce WordPress plugin through version 1.7.6. The plugin stores customer-uploaded files in a publicly web-accessible uploads directory. The access restrictions intended to protect these files are ineffective, enabling unauthenticated attackers who know or can guess file names to bypass the plugin's authenticated download mechanism and directly access customer-uploaded files.

An unauthenticated attacker can access customer-uploaded files without authorization by directly requesting files if the file names are known or guessed. This exposure can lead to unauthorized disclosure of potentially sensitive customer data stored in uploaded files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting web server access to the uploads directory or implementing additional access controls at the server or application level to prevent unauthorized file retrieval.