{"uuid": "a72f2a3b-34a0-49cc-b589-056234489fd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93550", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117421002067393161", "content": "CVE-2026-93550 Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.\nhttps://www.cve.org/CVERecord?id=CVE-2026-93550https://wpscan.com/vulnerability/09517757-2f99-42d5-8300-e1f618373059/#CVE_2026_93550#bot", "creation_timestamp": "2026-10-11T07:05:05.950518Z"}