{"metadata": {"vulnerability": "CVE-2026-107594", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-08T11:57:43.813Z", "date_only": false, "value": "2026-10-08T11:57:43.813Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-107594", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T06:00:11.937Z", "date_only": false, "value": "2026-10-14T06:00:11.937Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-107594", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T06:00:11.937Z", "date_only": false, "value": "2026-10-14T06:00:11.937Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-107594", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T07:17:02Z", "date_only": false, "value": "2026-10-14T07:17:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7X7H-Q4VM-3V3H", "record": "GHSA-7X7H-Q4VM-3V3H", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T07:17:02.090Z", "date_only": false, "value": "2026-10-14T07:17:02.090", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107594", "record": "FKIE_CVE-2026-107594", "field": "published"}, {"timestamp": "2026-10-14T09:31:31Z", "date_only": false, "value": "2026-10-14T09:31:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7X7H-Q4VM-3V3H", "record": "GHSA-7X7H-Q4VM-3V3H", "field": "published"}, {"timestamp": "2026-10-14T13:29:04.785Z", "date_only": false, "value": "2026-10-14T13:29:04.785148Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107594", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-14T13:29:04.785Z", "date_only": false, "value": "2026-10-14T13:29:04.785148Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107594", "record": "FKIE_CVE-2026-107594", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T13:42:22.350Z", "date_only": false, "value": "2026-10-14T13:42:22.350Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-107594", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T13:42:22.350Z", "date_only": false, "value": "2026-10-14T13:42:22.350Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107594", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T14:33:22.574Z", "date_only": false, "value": "2026-10-14T14:33:22.574086Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxtrc2g5qnkt", "record": "CVE-2026-107594", "field": "creation_timestamp", "uuid": "de3ba95c-8c47-4b14-ba63-29cb091d8ca2", "content": "CVE Radar | CVE-2026-107594 | CVSS 10.0\n\nUnauthenticated Arbitrary File Deletion\n\nCVE-2026-107594 affects the File Upload to Order WordPress plugin before version 1.1.4.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1266", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxtrc2g5qnkt"}, {"timestamp": "2026-10-14T15:00:06.043Z", "date_only": false, "value": "2026-10-14T15:00:06.043569Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtsrupf7l2l", "record": "CVE-2026-107594", "field": "creation_timestamp", "uuid": "e0daf502-cf3f-4578-90e4-692b1ddfbbdf", "content": "CVE-2026-107594 - file upload to order\nThe File Upload to Order WordPress plugin, versions before 1.1.4, allows a public user to delete files on the web server. This could let an attacker remove important files and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtsrupf7l2l"}, {"timestamp": "2026-10-14T15:32:17Z", "date_only": false, "value": "2026-10-14T15:32:17Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7X7H-Q4VM-3V3H", "record": "GHSA-7X7H-Q4VM-3V3H", "field": "modified"}, {"timestamp": "2026-10-14T16:14:02.800Z", "date_only": false, "value": "2026-10-14T16:14:02.800", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107594", "record": "FKIE_CVE-2026-107594", "field": "lastModified"}, {"timestamp": "2026-10-14T17:09:19.828Z", "date_only": false, "value": "2026-10-14T17:09:19.828811Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440365152424720", "record": "CVE-2026-107594", "field": "creation_timestamp", "uuid": "840a686f-3763-4931-a5b0-2edffcb9ef14", "content": "CVE-2026-107594 File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107594https://wpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/#CVE_2026_107594#bot", "url": "https://infosec.exchange/users/cve/statuses/117440365152424720"}]}