CVE-2026-8778

MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Description

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Analysis

Technical impact

The MIPL Grouped Checkout Fields for WooCommerce plugin contains a flaw in the mipl_wc_upload_file function where file type validation is omitted. This omission permits any visitor to upload a file of any type to the site’s server. The uploaded file can contain malicious code, potentially allowing an attacker to execute code on the server, compromise confidentiality, integrity, and availability of the site, and possibly pivot to other systems. The weakness corresponds to CWE-434, File Upload with Dangerous File Types.

Affected Systems

WordPress sites that have the MIPL Grouped Checkout Fields for WooCommerce plugin installed with version 1.2.1 or earlier are impacted. The affected vendor is mulika, and the plugin offers a Configure & Organize Checkout Fields feature.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity. Because the vulnerability is exploitable by unauthenticated users through the web interface, an attacker does not need special permissions to upload a file. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, but the lack of mitigation and high severity suggest a high likelihood of exploitation, especially on public-facing sites.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mulika

MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields.

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.2.2

No data.

Vendor Product Versions

Mulika

Mipl Grouped Checkout Fields For Woocommerce. Customize & Organize Checkout Fields.

Version	Status	Scheme	Platform
`[0,1.2.2]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the MIPL Grouped Checkout Fields for WooCommerce plugin to the latest version (≥ 1.2.2) which removes the missing type validation in mipl_wc_upload_file.
If a plugin upgrade is not immediately possible, disable the file upload handler by removing or deactivating the upload action within the plugin, or restrict upload capabilities for all users via role‑based permission settings.
Deploy a web application firewall or security plugin that enforces strict file type checks and blocks uploads of disallowed file extensions or MIME types.

Generated by OpenCVE AI on September 11, 2026 at 06:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.1% (1.141% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/include/class-mipl-wc-cf-checkout-block.php#L415
https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/mipl-wc-checkout-fields.php#L260
https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/trunk/include/class-mipl-wc-cf-checkout-block.php#L415
https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/trunk/mipl-wc-checkout-fields.php#L260
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3552029%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php&old=3549283%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1257a9-7c8e-43aa-b21a-93a77b456aa4?source=cve

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mulika Mulika mipl Grouped Checkout Fields For Woocommerce. Customize & Organize Checkout Fields. Wordpress Wordpress wordpress
Vendors & Products		Mulika Mulika mipl Grouped Checkout Fields For Woocommerce. Customize & Organize Checkout Fields. Wordpress Wordpress wordpress

Sep 11, 2026 4:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Title		MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
Weaknesses		CWE-434
References		https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/include/class-mipl-wc-cf-checkout-block.php#L415 https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/mipl-wc-checkout-fields.php#L260 https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/trunk/include/class-mipl-wc-cf-checkout-block.php#L415 https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/trunk/mipl-wc-checkout-fields.php#L260 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3552029%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php&old=3549283%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1257a9-7c8e-43aa-b21a-93a77b456aa4?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`