CVE Intelligence
Analysis AI-assisted

CVE-2026-56027: Booster for WooCommerce Arbitrary File Upload via Customer Accounts

Booster for WooCommerce versions up to and including 8.0.1 contain an arbitrary file upload flaw reachable through customer functionality, classified as CWE-434. The CNA rates it critical with a CVSS 3.1 base score of 9.9. The record lists no fixed version and does not show a KEV listing or confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56027 describes an arbitrary file upload issue in Booster for WooCommerce, affecting versions up to and including 8.0.1. The record classifies the weakness as CWE-434 (unrestricted upload of a file with a dangerous type) and associates it with customer-facing upload functionality.

Impact

  • The CVSS 3.1 vector supplied by the CNA rates confidentiality, integrity and availability impact as high, with network attack vector, low attack complexity, low privileges required and no user interaction.
  • The vector includes a scope change, so consequences may extend beyond the vulnerable component. The record does not describe the specific consequences.

Affected products and versions

  • Booster for WooCommerce, versions up to and including 8.0.1, according to the record description.
  • The record contains no structured list of affected or fixed versions, so the exact boundary of the fix is unknown.

Exploitation status

  • The record shows that this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.00479 and a percentile of 0.39631.

Remediation and mitigation

  • Check the vendor or the plugin listing for a version newer than 8.0.1 and apply it, since the record does not name a fixed version.
  • Until an update is applied, limit which accounts can use customer features that accept file submissions, and restrict accepted file types on the server side.
  • Review whether upload directories allow server-side scripts to run, and remove that permission where it is not needed.

Detection guidance

  • Review recently added files in plugin upload locations for unexpected types, extensions or names.
  • Monitor for customer accounts that suddenly submit many files or files with unusual types.

Limitations of the available information

  • The record has no fixed version, no detailed technical description and no vendor-confirmed exploitation data.
  • The record lists only the CNA CVSS score. Its EPSS date is later than its publication date; this analysis reports the values as given.
  • The record shows the source status as Deferred, so further details may appear later.

Frequently asked questions

Which versions of Booster for WooCommerce are affected by CVE-2026-56027?

According to the record description, versions up to and including 8.0.1 are affected. The record does not list a fixed version, so check the vendor for an update.

Is CVE-2026-56027 known to be actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.