A missing file type validation flaw in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin lets unauthenticated attackers upload arbitrary files to affected servers, potentially leading to remote code execution.
What Is It
CVE-2026-8778 is an arbitrary file upload vulnerability (CWE-434) in the mipl_wc_upload_file function of the MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress. The function does not validate the type of uploaded files. Because the upload path is reachable without authentication, any remote attacker can place files of their choosing on the site's server, which may make remote code execution possible.
The CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, is the score supplied by the CNA (Wordfence). NVD has not independently analyzed or scored this CVE, its status is Deferred, meaning NVD is not adding its own enrichment or CVSS assessment to the record. The 9.8 should therefore be read as a vendor-assigned severity, not an NVD-validated one. On its own terms, every metric points the wrong way: network-reachable, low attack complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability.
Why It Matters
Unauthenticated file upload on a WordPress site is about as direct a path to full compromise as exists. There is no credential barrier and no victim interaction required; an attacker only needs to reach the endpoint. Where the uploaded file lands in a web-servable location, the result is webshell-grade access to a site that, as a WooCommerce storefront, is likely to hold customer and order data.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog based on the supplied data, so there is no confirmed active exploitation and no KEV-mandated remediation deadline at this time. The absence of NVD scoring is likewise not a reason to discount the finding; the CNA's technical description, an unauthenticated path with no file type validation, is consistent with the critical rating and with a trivial exploitation profile.
What's Vulnerable
- Vendor: mulika
- Product: MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields (WordPress plugin)
- Affected versions: The CVE description cites all versions up to and including 1.2.1; the structured affected-version data lists versions up to and including 1.2.2 as affected. With NVD analysis deferred, this discrepancy has not been reconciled by a third party; treat 1.2.2 and below as vulnerable until the vendor clarifies.
Patch Status
The supplied record lists no fixed version and no vendor advisory beyond the WordPress plugin source and changeset references. A WordPress.org Trac changeset is referenced against class-mipl-wc-cf-checkout-block.php, indicating upstream code movement in the affected file. Operators should verify their installed version, consult the Wordfence entry, the originating CNA and the most current source of fix guidance here, and consider removing the plugin if no patched release is available.
Sources
- NVD, CVE-2026-8778: https://nvd.nist.gov/vuln/detail/CVE-2026-8778
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1257a9-7c8e-43aa-b21a-93a77b456aa4?source=cve
- WordPress Plugin Trac,
class-mipl-wc-cf-checkout-block.php(tag 1.2.1): https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/include/class-mipl-wc-cf-checkout-block.php#L415 - WordPress Plugin Trac,
mipl-wc-checkout-fields.php(tag 1.2.1): https://plugins.trac.wordpress.org/browser/mipl-wc-checkout-fields/tags/1.2.1/mipl-wc-checkout-fields.php#L260 - WordPress Plugin Trac; changeset 3552029: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3552029%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php&old=3549283%40mipl-wc-checkout-fields%2Ftrunk%2Finclude%2Fclass-mipl-wc-cf-checkout-block.php&sfp_email=&sfph_mail=