{
 "id": "WPSEC-2026-0666",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0666/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0666/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0666/index.md",
 "title": "FoxyShop <= 4.9.7 - Missing Authorization to Unauthenticated Limited File Upload",
 "description": "The FoxyShop plugin for WordPress is vulnerable to unauthorized file uploads in all versions up to, and including, 4.9.7 due to a missing capability check on the product image upload branch of the plugin's upload endpoint. This makes it possible for unauthenticated attackers who know the endpoint's URL key to upload files of the allowed image and document types to the media library and attach them to any product.",
 "plugin": {
  "slug": "foxyshop",
  "name": "FoxyShop",
  "full_name": "FoxyShop",
  "wordpress_org": "https://wordpress.org/plugins/foxyshop/",
  "advisories_url": "https://wpsec.com/vuln/plugin/foxyshop/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/foxyshop"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.9.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.9.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.9.8",
 "remediation": "Update to 4.9.8 or later.",
 "fix_released": "2026-10-07T15:44:22+00:00",
 "published": "2026-10-08T15:50:18+00:00",
 "updated": "2026-10-07T18:51:17.910905+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0666/",
  "https://plugins.svn.wordpress.org/foxyshop/tags/4.9.8/",
  "https://wordpress.org/plugins/foxyshop/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/foxyshop",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-08"
 }
}