4.3
Medium
CVE-2026-93550 The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote…
Description
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Veeqo for WooCommerce 2.2 | earliest → 2.2.8 | No fix stated |