CVE-2026-14314

MediumCVSS 5.3

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token. This allows unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.

Risk Assessment

An attacker can access sensitive customer data such as payment receipts, violating privacy and potentially leading to fraud.

Recommendation

Update the PeproDev WooCommerce Receipt Uploader plugin to the latest version if a fix is available. Additionally, implement authorization mechanisms to verify ownership of attachments.

Other vulnerabilities in PeproDev WooCommerce Receipt Uploader WordPress plugin

CVE-2026-14313Medium
PeproDev WooCommerce Receipt Uploader WordPress plugin (slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0, is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.

Original NVD description (English source)

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS