CVE-2026-6802

MediumCVSS 5.3/10Last modified Jul 10, 2026

Description

The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1. This is due to missing authorization checks in the ufdc_custom_init() function, which processes the 'eufdc-delete' parameter without any nonce verification, capability check, or attachment ownership validation. This makes it possible for unauthenticated attackers to permanently delete arbitrary media library attachments from the WordPress site.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2026
Last modified
Jul 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-68035.3The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and includinCVE-2026-68045.3The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includingCVE-2026-68057.5Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the seCVE-2026-68067.5The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lCVE-2026-680607.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-680625.8SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can logCVE-2026-680679.8The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for tCVE-2026-680689.0The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-CVE-2026-68075.5A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintendedCVE-2026-680708.8The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytCVE-2026-680737.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issuCVE-2026-680747.5A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This