Booster for WooCommerce: customer arbitrary file upload (CVE-2026-56027)
An arbitrary file upload vulnerability reachable by a store customer has been recorded in the WordPress plugin Booster for WooCommerce (CVE-2026-56027, CVSS 9.9). The entry gives no further details.
Checked in Shield: no
Who is affected
Affected versions are not disclosed yet. In practice this concerns WordPress sites that have the Booster for WooCommerce plugin installed.
How to check
In the WordPress admin, check whether the plugin is installed and which version it is. It is also worth reviewing wp-content/uploads for unexpected file types, such as PHP.
How to fix
No fixed version has been stated yet. Watch the NVD entry and the vendor's releases, and install the patch once it is published.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Affected and fixed versions and any exploitation are not disclosed yet; source: NVD (CVE-2026-56027).
