CVE-2026-14313

MediumCVSS 5.3

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

PeproDev WooCommerce Receipt Uploader WordPress plugin (slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0, is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.

Risk Assessment

An unauthenticated attacker can modify order data or upload unauthorized content, potentially leading to data integrity issues.

Recommendation

Update the PeproDev WooCommerce Receipt Uploader plugin to the latest version if a fix is available. Additionally, restrict write functionality to authenticated users with appropriate permissions.

Other vulnerabilities in PeproDev WooCommerce Receipt Uploader WordPress plugin

CVE-2026-14314Medium
The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token. This allows unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.

Original NVD description (English source)

PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0 (latest on wordpress.org; no fixed version available at the time of writing), is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS