4.3
Moyenne
CVE-2026-93550 The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote…
Description
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Veeqo for WooCommerce 2.2 | premières → 2.2.8 | Pas de correctif indiqué |