The vulnerability is an IDOR flaw in the WP Wham Checkout Files Upload for WooCommerce plugin that permits an authenticated user to bypass access controls and upload or modify files on the server. Because the file upload endpoint does not validate that the requester is authorized to act on the target location, an attacker can supply arbitrary file paths or names and retrieve or replace confidential files. The flaw is classified as CWE‑639, indicating an exploitation of inadequate authorization checks.

WP Wham – Checkout Files Upload for WooCommerce plugin. Versions affected are all releases through and including 2.2.5; no newer versions have been listed as vulnerable in the current advisory.

The CVSS score of 6.5 denotes a moderate level of severity for this vulnerability, while the EPSS score is not available at this time and it is not listed in CISA’s KEV catalog. The likely attack vector is via HTTP requests to the file‑upload endpoint, enabling any user with access to the WordPress site to abuse the endpoint to upload or alter files. Although no public zero‑day exploit has been documented, the absence of stringent access checks makes the flaw readily exploitable with minimal technical effort.