CVE-2026-14313 PUBLISHED

PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR

Assigner: WPScan
Reserved: 01.07.2026 Published: 06.08.2026 Updated: 06.08.2026

PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0 (latest on wordpress.org; no fixed version available at the time of writing), is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.

Product Status

Vendor Unknown
Product PeproDev WooCommerce Receipt Uploader
Versions Default: unknown
  • affected from 0 to 2.8.0 (incl.)

Credits

  • Lyris Vale finder
  • WPScan coordinator

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE
  • CWE-352 Cross-Site Request Forgery (CSRF) CWE