The Drag and Drop Multiple File Upload for WooCommerce plugin versions prior to 1.1.8 do not properly restrict access to the file-deletion functionality. Specifically, unauthenticated users can obtain a valid nonce token that gates the deletion process. This lack of proper access control leads to an external control of file name or path vulnerability (CWE-73), allowing attackers to delete files in the upload directory. The vulnerability impacts the integrity and availability of customer order attachments by enabling irreversible deletion.

The vulnerability allows anonymous attackers to delete files staged for upload, which can result in the loss of pending order attachments for customers. This compromises the integrity and availability of critical data related to customer orders, potentially disrupting business operations and customer trust. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload directory and monitor for suspicious deletion activity. Avoid exposing the file-deletion endpoint to unauthenticated users if possible.