CVE-2026-24625: 
WordPress vulnerability analysis and mitigation

CVE-2026-24625 is a Missing Authorization vulnerability in the File Uploads Addon for WooCommerce plugin (slug: woo-addon-uploads) developed by Imaginate Solutions. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially exposing sensitive information. The vulnerability affects all plugin versions from n/a through 1.7.3 (inclusive). It was published on January 23, 2026, with the CVE assigned by Patchstack. The CVSS v3.1 base score is 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality or data. Because no authentication or privilege check is enforced on the vulnerable endpoint(s), any unauthenticated network attacker can send crafted HTTP requests to trigger the access control bypass. The attack requires no user interaction, no special privileges, and low complexity, making it straightforward to exploit over the network (Feedly, Patchstack).

Successful exploitation results in a low-level confidentiality impact — unauthenticated attackers can access data or functionality that should be restricted to authorized users (e.g., viewing uploaded files or order-related file attachments in WooCommerce). There is no direct integrity or availability impact based on the current CVSS assessment. In a WooCommerce context, exposed file uploads could include customer-submitted documents, invoices, or other sensitive order attachments, representing a meaningful data exposure risk for affected store operators and their customers (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.028%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

WordPress site administrators should update the File Uploads Addon for WooCommerce plugin to a version beyond 1.7.3 that includes the authorization fix. Until a patched version is available or applied, consider deactivating the plugin on publicly accessible WooCommerce stores to eliminate the attack surface. Additionally, review web server access logs for unexpected unauthenticated requests to plugin-specific endpoints handling file upload or retrieval functionality (Patchstack).

Coverage of this vulnerability has been limited to automated vulnerability aggregation platforms and security news feeds, with no notable researcher commentary or vendor statements beyond the Patchstack disclosure. A brief mention appeared on Systemtek's security blog shortly after publication (Systemtek). Overall community interest appears low, consistent with the medium severity rating and narrow affected product scope.