PeproDev Receipt Uploader for WooCommerce
PeproDev Receipt Uploader for WooCommerce has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 5.7, and the most serious one scores 6.1 out of 10. 2026 was the busiest year with 2 disclosures.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting.
Every one of the 4 issues recorded for PeproDev Receipt Uploader for WooCommerce has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. PeproDev Receipt Uploader for WooCommerce is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-24574PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

PeproDev Receipt Uploader for WooCommerce
Author
Pepro Dev. Group
woocommercePeproDev Receipt Uploader for WooCommerce is made for stores that accept bank transfers, card-to-card, cash deposits or any offline payment. After checkout the customer uploads the payment receipt on the thank-you page or in My Account, and the shop manager approves or rejects it from the order screen. Features Receipt upload for any payment method (BACS, cheque, cash on delivery or any custom gateway) Upload form on the thank-you page and on the My Account order details page Approve, reject or reset receipts from the order screen, with an admin note for the customer Automatic order status change on order placed, receipt uploaded, approved and rejected Three extra order statuses: Awaiting Receipt Upload, Awaiting Receipt Approval and Receipt Rejected Six WooCommerce emails (uploaded, approved and rejected, for customer and admin), fully customizable from WooCommerce > Settings > Emails Allowed file types (JPG, PNG, WEBP, GIF, BMP, AVIF, HEIC, PDF) and maximum file size Custom content before and after the upload form (HTML and shortcodes), custom form title and optional redirect after upload Receipt column in the orders list and a receipt filter in the media library Shortcodes: [receipt-form] and [receipt-preview] Compatible with High-Performance Order Storage (HPOS) and WooCommerce Subscriptions RTL ready, translation ready Security Receipts are stored in a protected folder (wp-content/uploads/receipt_upload) with random file names Receipts are only shown through signed links that are bound to the order they belong to Only the order owner (or a guest with the order key) and shop managers can upload or view a receipt Files are validated by their real content, not only by extension The Help & Tools tab checks whether your server blocks direct access to the receipt folder and gives you an Nginx rule if it does not Developer hooks Actions: peprodev_uploadreceipt_customer_uploaded_receipt, peprodev_uploadreceipt_receipt_status_changed, peprodev_uploadreceipt_receipt_approved, peprodev_uploadreceipt_receipt_rejected, peprodev_uploadreceipt_receipt_awaiting_upload, peprodev_uploadreceipt_receipt_awaiting_approval, peprodev_uploadreceipt_order_placed, peprodev_uploadreceipt_save_receipt, peprodev_uploadreceipt_email_receipt_preview Filters: peprodev_uploadreceipt_folder_name, peprodev_uploadreceipt_allowed_file_mimes, peprodev_uploadreceipt_max_upload_size, peprodev_uploadreceipt_safe_mimes jQuery events on document: peprodev_receipt_uploader_ajax_prevented, peprodev_receipt_uploader_ajax_success, peprodev_receipt_uploader_ajax_failed, peprodev_receipt_uploader_ajax_completed Credits Developed at BlackSwanDev and Pepro Dev Lead Developer: AmirhpCom Security reports: Lyris Vale, Shivamani Vastrala, Mika (Patchstack), vgo0 (Wordfence) Disclaimer and Warranty This plugin is provided “as is” without any warranties, express or implied. Always test in a staging environment before deploying to production.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C