Vulnerabilities / FoxyShop / WPSEC-2026-0666
FoxyShop <= 4.9.7 - Missing Authorization to Unauthenticated Limited File Upload
Low 3.7
CWE-862Fixed in 4.9.8
- ID
- WPSEC-2026-0666
- Plugin
- FoxyShop (foxyshop)
- Affected
- all versions before 4.9.8
- Remediation
- Update to 4.9.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-08
- Attack surface
- FoxyShop on WPSec AttackSurface
- Fix released
- Published
Description
The FoxyShop plugin for WordPress is vulnerable to unauthorized file uploads in all versions up to, and including, 4.9.7 due to a missing capability check on the product image upload branch of the plugin's upload endpoint. This makes it possible for unauthenticated attackers who know the endpoint's URL key to upload files of the allowed image and document types to the media library and attach them to any product.
References
- https://wpsec.com/vuln/WPSEC-2026-0666/
- https://plugins.svn.wordpress.org/foxyshop/tags/4.9.8/
- https://wordpress.org/plugins/foxyshop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS