CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-8778 — The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout...

·Source: NIST NVD

Updated:

Executive Summary

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote

Analysis

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSS Score: 9.8. Published: 2026-09-11T04:18:04.617.

Indicators of Compromise (1)

CVE (1)
CVE-2026-8778
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 11, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-78159 — The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut...

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it p

CVE-2026-78159
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-78006 — The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut...

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attri

CVE-2026-78006
NIST NVD
MEDIUMVulnerability

Cylake Gets $245M to Build Cloud-Free Cybersecurity Platform

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cylake-gets-245m-to-build-cloud-free-cybersecurity-platform-image_small-1-a-32807.jpg" align=right hspace=4><b>Nir Zuk's Startup Targets Firms Unable to Send Sensitive Security Data to the Cloud</b><br>Cylake, led by Palo Alto Networks founder Nir Zuk, raised $245 million to build an on-premises cybersecurity system combining hard

Bank Info Security