The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
The File Upload to Order WordPress plugin before version 1.1.4 contains a critical arbitrary file deletion vulnerability that allows unauthenticated attackers to delete arbitrary files from the server. The flaw stems from insufficient validation of file paths derived from attacker-controlled session data combined with an unprotected deletion action accessible to anonymous users. This creates a direct path to server compromise, as attackers can systematically remove critical files—including configuration files, database connectors, or security plugins—that maintain site integrity and functionality. WordPress installations using this plugin are at severe risk, particularly those in production environments where file deletion can cascade into complete site takeover or data loss.
While this CVE lacks explicit MITRE ATT&CK mappings, the attack pattern aligns with Defense Evasion, Impact, and Resource Development techniques. Practitioners leveraging Casky's Claude-powered analysis would observe indicators consistent with T1070 (Indicator Removal) and T1485 (Data Destruction)—specifically, unauthorized file system modifications originating from unauthenticated sessions paired with anomalous deletion patterns targeting system-critical paths. Although Casky currently shows zero matching skills for this specific CVE, the platform's 754 mapped security skills would surface related defensive controls around authentication enforcement, file access controls, and input validation. Security teams should prioritize identifying vulnerable plugin versions, implementing Web Application Firewalls (WAF) rules to block suspicious session-based file operations, and enforcing strict file system permissions as compensating controls while awaiting patched versions.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-107594. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation