CVE-2026-14314 PeproDev CVE debrief

Who should care

Users of the PeproDev WooCommerce Receipt Uploader WordPress plugin, particularly those who have uploaded sensitive customer information, should take immediate action to protect their systems. This includes verifying the plugin version, restricting access to sensitive customer information, and monitoring for suspicious activity related to the plugin. Additionally, operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to mitigate the risk.

Technical summary

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own. This vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Users of the plugin, particularly those who have uploaded sensitive customer information, should take immediate action to protect their systems.

Defensive priority

Medium priority due to potential for unauthorized access to sensitive customer information.

Recommended defensive actions

• Verify the plugin version and ensure it is updated to a patched version
• Restrict access to sensitive customer information
• Monitor for suspicious activity related to the plugin
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token. Evidence is limited; further verification is needed. The vulnerability allows unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources