CVE-2026-8778
The MIPL Grouped Checkout Fields for WooCommerce plugin for WordPress allows unauthenticated attackers to upload arbitrary files because it does not validate file types. This flaw could let attackers place malicious code on the server, potentially enabling remote code execution. The vulnerability affects all versions up to and including 1.2.1.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using the MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin, versions up to and including 1.2.1.
Real-world impact
An attacker could upload a malicious script or executable file to the server, which could then be run to take control of the site, steal data, or spread malware.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network, requires no authentication, and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources