HDWebmobile Product File Upload

HDWebmobile Product File Upload

Let customers upload a file with a personalized product. Accepted file types are always a hardcoded safe list — never “allow all”.

Overview

HDWebmobile Product File Upload adds a file-upload field to any product — perfect for personalized items like custom mugs, printed t-shirts, or engraved gifts where the customer supplies their own photo, artwork, or PDF. The file is attached to the cart item and order, and shows up as a downloadable link on the order confirmation, order emails, and the backend order screen.

Why This Plugin Exists

A competing “Product Input Fields for WooCommerce” plugin had a critical unauthenticated arbitrary file upload vulnerability (CVE-2026-19089, CVSS 9.8): when its “accepted file types” setting was left blank, the plugin treated that as permission to accept any file type, including PHP scripts — letting an unauthenticated attacker upload and potentially execute a script on the server. This plugin closes that exact failure mode by construction:

• There is no “accept all file types” setting anywhere in this plugin, at any level — the full universe of acceptable types (JPG, PNG, GIF, WEBP, PDF) is a fixed list in the plugin’s own code, not a database value.
• Every upload is independently verified against its actual file content using WordPress core’s own wp_check_filetype_and_ext(), not just the filename extension the browser reports.
• A hardcoded denylist of dangerous extensions (.php and its variants, .exe, .sh, .svg, and others) is checked before anything else, as defense in depth on top of the allow-list.
• Every file is processed through WordPress core’s own wp_handle_upload(), never a hand-written upload routine.

Key Features

• Add a file-upload field to any product, optional or required
• Custom field label per product (e.g. “Upload your photo”)
• Choose which of the safe file types (JPG, PNG, GIF, WEBP, PDF) this product accepts
• Configurable max file size per product, capped at a hard 20MB ceiling
• Uploaded file appears as a link on the cart, checkout, order confirmation, order emails, and the backend order screen

How to Use

1. Enable uploads on a product. Edit the product, go to the General tab, check “File Upload”, optionally check “Required”, and choose which file types to accept.

2. Customers upload their file. On the product page, the customer sees the upload field above Add to Cart, with the accepted types and size limit shown.

3. You see the file on the order. The uploaded file’s link appears on the cart, checkout review, order confirmation, order emails, and the backend WooCommerce order screen.

Limitations

Please read before installing:

• Only JPG, PNG, GIF, WEBP, and PDF are ever accepted — there is no way to add other file types, by design
• Simple products only in this version

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-product-file-upload directory, or install through the Plugins screen directly.
2. Activate the plugin. WooCommerce must already be installed and active.
3. Edit any product, and in the General tab check “File Upload”, set a label, choose accepted types, and set a max size.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: per-product file upload field with a hardcoded safe type allow-list, content-based type verification, hard file-size ceiling, and the uploaded file surfaced on cart, checkout, order confirmation, order emails, and the backend order screen.)

See our other WordPress plugins for more WooCommerce and site-utility tools.