CVE-2026-93550: CWE-434 Unrestricted Upload of File with Dangerous Type in Veeqo for WooCommerce

CVE-2026-93550 is a vulnerability in the Veeqo for WooCommerce WordPress plugin through version 2.2.8. The plugin does not restrict which users can initiate its remote bridge-installation process nor validate the URLs provided for downloading. This lack of access control and input validation enables users with Subscriber-level privileges or above to force the plugin to download and extract attacker-controlled archives containing arbitrary PHP files into the WordPress root directory, potentially leading to remote code execution or site compromise.

An attacker with Subscriber-level access or higher can upload and execute arbitrary PHP files on the affected WordPress site by exploiting this vulnerability. This can lead to full site compromise, including unauthorized code execution, data theft, or persistent backdoors. The vulnerability arises from insufficient access control and lack of URL validation in the plugin's remote installation process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities and monitor for suspicious activity related to the plugin's remote installation feature. Consider disabling or removing the Veeqo for WooCommerce plugin if it is not essential.