Scan my site freeScan free

Fix guides / Security notices

Security notice

WooCommerce store using Checkout Files Upload? A flaw rated 9.8 can let anyone upload a PHP file. Update to 2.4.0.

Last updated: Wednesday, November 4, 2026, 8:15 AM ETStatus: Fix released. Attacks reported by Patchstack and BitNinja. Update now.

Checkout Files Upload for WooCommerce is a WordPress plugin that lets shoppers upload files, such as artwork or documents, with their order. WordPress.org lists 7,000+ active installations. In versions before 2.4.0, if the plugin's "accepted file types" setting is left blank, which the plugin documented as the way to accept all files, anyone with no account can upload any file, including PHP code. On servers that run PHP from the uploads folder, that means a stranger running their own code on your site. The CVE record, CVE-2026-103688, published October 28, 2026, rates it 9.8 out of 10. Version 2.4.0, released October 20, 2026, fixes it. Patchstack labels the flaw "Known to be exploited" and web firewall company BitNinja said on November 3 that it is "actively exploited". Neither gives attack numbers or names a victim, and CISA does not list it as exploited. If your store runs this plugin, update it to 2.4.0 today, set the accepted file types to the list you actually need, and check the uploads folder for PHP files.

What happened

Who should worry

This is about WordPress stores running WooCommerce that let customers upload files at checkout or with an order. If you are not sure whether your store uses this plugin, ask your web developer or agency. Ask about this if any of these are true:

If your store does not use this plugin, this notice does not apply to you.

What to do now

Do these today.

  1. Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "Checkout Files Upload for WooCommerce". Note the version. 2.4.0 has the fix.
  2. Update to 2.4.0 after taking a backup, and confirm the version afterwards. For the Premium edition, ask WP Wham for the fixed build. (WordPress.org, PowerSEC)
  3. Set an explicit list of allowed file types. In WooCommerce, then Settings, then Checkout Files Upload, enter only the types your store really needs, such as pdf or jpg. The 2.4.0 changelog says other types must now be listed by hand, so a store that needs more than WordPress's normal types will have to list them. Do not add script types such as php. (changelog, PowerSEC)
  4. Check for a break-in, especially if the setting was blank before you updated. Ask your developer or host to look for .php, .phtml or .phar files under wp-content/uploads, for requests to such files in the web server logs, and for administrator accounts and plugins you did not add. PowerSEC says a file that matches is not proof of an attack, a clean result is not proof of safety, and updating does not remove files uploaded before. If you find something you cannot explain, keep a copy of the site and involve your host. (PowerSEC)
  5. Ask your host to stop PHP running in the uploads folder. PowerSEC suggests this as separate hardening. The CVE says code only runs on servers that run PHP from there. (PowerSEC, CVE record)
  6. If you cannot update today, deactivate the plugin until you can. That is our suggestion, not the maker's, and it will stop customer uploads while it is off.
  7. Check your store afterwards. Place a test order with a normal file and confirm the upload arrives with the order. (PowerSEC)

What to send your developer, agency or host

Checkout Files Upload for WooCommerce before 2.4.0 has a critical flaw, CVE-2026-103688 (CVSS 9.8, CVE published October 28, 2026): when the accepted file types setting is blank, unauthenticated users can upload arbitrary files, including PHP, which leads to remote code execution where PHP runs from the uploads directory. Patchstack labels it known to be exploited, and BitNinja said on November 3 that it is actively exploited. 2.4.0 (October 20, 2026) is the fix. Please update to 2.4.0, set an explicit list of allowed file types, check wp-content/uploads and the access logs for PHP files and requests to them, check for administrator accounts and plugins we do not recognize, and make sure PHP cannot run from the uploads folder. Thank you. Sources: CVE record, WPScan, Patchstack, BitNinja.

Common questions

Has my store been hacked?

This notice does not mean your store has been hacked. It means a critical flaw has a fix, and two security firms say it is being exploited. The way to know is to update and do the checks above.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs, which versions they are on or what files are on your server, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Is my store safe if the setting was not blank?

The CVE record describes the flaw only for a blank setting. Update anyway, since you may not know what the setting was in the past. (CVE record)

Is it on CISA's list?

No. CISA KEV does not list CVE-2026-103688 in its catalog version dated November 3, 2026, checked November 4. Patchstack's "KEV" label is its own. (CISA KEV, PowerSEC)

Where can I follow official updates?

The plugin's changelog, the WPScan advisory and the Wordfence entry. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan cannot see which WordPress plugins your site runs, which version they are on, or what files are on your server. No account.

Or sign up free and we check it every day and email you when something changes.