Threats tagged 'ghsa-hf2w-m5c9-frx7'

CVE-2026-14314 is a medium severity vulnerability in the PeproDev WooCommerce Receipt Uploader WordPress plugin up to version 2.8.0. The plugin fails to verify that an attachment requested via an access token belongs to the referenced order. This flaw allows unauthenticated attackers to forge tokens and access image attachments, including payment receipts uploaded by other customers, leading to unauthorized disclosure of sensitive information.