The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin is vulnerable to unauthenticated file deletion, posing a critical risk to data integrity and order processing.

The plugin fails to perform adequate access control checks for its file-deletion routine, allowing unauthenticated attackers to obtain a valid nonce and subsequently delete files staged in the upload directory.

Successful exploitation results in the unauthorized destruction of customer files, which can cause significant operational disruption and loss of critical business documentation. Given the CVSS score of 9.1, this vulnerability is classified as critical due to the ease of remote, unauthenticated access and the high impact on data integrity and availability.

Immediate Action: Update the Drag and Drop Multiple File Upload for WooCommerce plugin to version 1.1.8 or later immediately.

Proactive Monitoring: Review web server access logs for unusual requests directed at file-handling endpoints or high volumes of deletion attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious requests containing unexpected nonce patterns or unauthorized attempts to access the plugin upload directories.

Public Exploit Available: No

The severity of this vulnerability, combined with the lack of authentication requirements, necessitates immediate remediation. Organizations utilizing this plugin must verify their current version and apply the 1.1.8 update without delay to prevent potential data loss and service disruption.