CVE-2026-14314 PUBLISHED

PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

Assigner: WPScan
Reserved: 01.07.2026 Published: 06.08.2026 Updated: 06.08.2026

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.

Product Status

Vendor Unknown
Product PeproDev WooCommerce Receipt Uploader
Versions Default: unknown
  • affected from 0 to 2.8.0 (incl.)

Credits

  • Shivamani Vastrala finder
  • WPScan coordinator

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE