Product File Upload for WooCommerce
Product File Upload for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 8.1, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Path Traversal, behind 1 of the records (100%).
The one issue recorded for Product File Upload for WooCommerce has a vendor fix available, so running the current release closes it.
All of these findings were reported by Denver Jackson. Product File Upload for WooCommerce is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.3.
CVE-2026-25328Product File Upload for WooCommerce <= 2.2.4 - Unauthenticated Arbitrary File Deletion
Read the full analysisVulnerability Records

Product File Upload for WooCommerce
Author
add-ons.org
woocommerceProduct File Upload for WooCommerce is the ultimate solution to collect files from your customers directly on the product single page. Whether you sell personalized mugs, custom t-shirts, or professional services that require document submissions, this plugin makes the process seamless and professional. With AJAX background uploading, your customers don’t have to wait for the page to reload. Files are uploaded the moment they are dropped, ensuring a smooth and conversion-friendly checkout experience. Key Benefits: Background AJAX Uploads: Files upload instantly upon selection, preventing timeouts and form submission issues. Multiple File Support: Let customers upload one or many files with ease. Order Integration: Uploaded files are automatically linked to the WooCommerce order, visible to both customers and admins. Responsive & Mobile-Ready: Works perfectly on desktops, tablets, and smartphones. Daily Cleanup: Automatically manages temporary storage to keep your server clean. DEMO: View Live Demo PRO VERSION: Upgrade for Pro Features DOCUMENTATION: Setup Guide Features Modern Drag & Drop UI: A beautiful, intuitive upload area that fits any WooCommerce theme. AJAX Progress Bar: Real-time feedback for file upload status. Individual Product Control: Enable or disable the upload field specifically for certain products. File Type & Size Validation: Restrict uploads by extension (JPG, PDF, ZIP, etc.) and set MB limits. Image Thumbnails: (Pro) Show instant previews of uploaded images. Multilingual Support: Fully compatible with WPML, Polylang, and Loco Translate. Email Attachments: Send uploaded files directly as email attachments to the store admin.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C