PatchSiren

PeproDev CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM PeproDev CVE published 2026-08-06

CVE-2026-14314

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token. This vulnerability allows unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own. Affected product deployments should be verified, and owners s [truncated]