Unauthenticated Nonce Exposure Enables File Deletion in WooCommerce

The Drag and Drop Multiple File Upload plugin for WooCommerce contains a critical authentication bypass vulnerability where unauthenticated attackers can obtain valid nonces—security tokens meant to prevent unauthorized actions—that gate the file deletion functionality. This allows anonymous users to delete files in the plugin's upload directory, irreversibly destroying customer order attachments and disrupting business operations. Any WooCommerce store using this plugin before version 1.1.8 is vulnerable, directly impacting order integrity, customer trust, and potential compliance violations if attachments contain sensitive data. The 9.1 CVSS score reflects the ease of exploitation and severe business impact with no authentication barrier.

While this CVE currently has zero matching Casky skills, practitioners investigating similar vulnerabilities would leverage Casky's 754 MITRE ATT&CK-mapped security skills and Claude's extended reasoning to identify attack patterns around credential and authentication bypass (T1110, T1078 class techniques). The detection approach would focus on observing unauthorized nonce generation and redemption patterns—monitoring for repeated delete requests from unauthenticated sources, unexpected nonce issuance in web logs, and bulk file deletions without corresponding authenticated sessions. A practitioner using Casky would correlate suspicious API calls to the deletion endpoint with absence of valid user sessions, identify the broken access control flaw in code review, and map remediation to enforcing proper nonce validation tied to authenticated users rather than exposing tokens universally.