Critical Severity
CVE-2026-103688
Published: Nov 2, 2026
CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
# CVE-2026-103688 — Checkout Files Upload for WooCommerce < 2.4.0
**Unauthenticated arbitrary file upload leading to remote code execution (RCE)**
> **Author:** NØXCRYPT · [@noxcrypt-x](https://github.com/noxcrypt-x)
>
> **Disclaimer:** This repository is provided for security research and authorized testing only. Do not use it against systems you do not own or have explicit permission to test. The author is not responsible for any misuse.
>
> **Repository contents:** PoC script and documentation only. The plugin sources (`src/`), WooCommerce archives (`*.zip`), and local lab files are not included.
| | |
|---|---|
| Product | Checkout Files Upload for WooCommerce (WordPress plugin by WP Wham) |
| Affected versions | All versions before 2.4.0 |
| Fixed in | 2.4.0 (released October 20, 2026) |
| Class | CWE-434 — Unrestricted Upload of File with Dangerous Type |
| CVSS 3.1 | 9.8 Critical — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Identifiers | CVE-2026-103688 |
| Source review | 2.3.0 (`Stable tag: 2.3.0`) |
---
## 1. Summary
Checkout Files Upload for WooCommerce lets customers upload files during or after checkout. Each uploader has an **Accepted file types** setting. When that setting is left empty, the plugin documents the behavior as "accept all files" — and `validate_file_type()` skips validation completely.
The AJAX handler `alg_ajax_file_upload` is registered for both `wp_ajax_` and `wp_ajax_nopriv_`, so unauthenticated visitors can call it. The nonce it requires is generated with action `wpwham-checkout-files-upload-<order_id>` and printed into the checkout HTML as a hidden input; before checkout, `order_id` is `0`, so any visitor can obtain a valid nonce.
The uploaded file is first moved to a temporary file. On order creation, `add_files_to_order()` writes it to:
```text
wp-content/uploads/woocommerce_uploads/alg_uploads/checkout_files_upload/<order_id>_<uploader>_<key>.<ext>
```
The original extension is preserved. A `.php` upload therefore becom