Product Addons CVE-2026-12968

Exploitation requires that the target site run the Product Addons and Product Options With Custom Fields plugin below 1.6.15 with its unauthenticated file-upload endpoint reachable, and that the endpoint accept and store SVG files served inline (image/svg+xml rendered in-browser rather than forced download) - these are the concrete preconditions named in the description. The upload itself needs no authentication (PR:N), but the payload only fires when a victim, ideally an administrator, actively opens the uploaded SVG (UI:R); this user-interaction requirement is the primary limiting factor and is why CISA SSVC marks the attack non-automatable. There is no confirmation of active exploitation (SSVC Exploitation: none; not in CISA KEV), so realistic risk depends on an attacker's ability to socially engineer a privileged user into viewing the file.

Signals are mixed but lean toward a genuine priority for exposed WooCommerce stores. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms network-reachable, low-complexity, unauthenticated exploitation, with the single caveat of required user interaction (UI:R) - an admin must open the uploaded SVG. Public exploit code exists, raising practical exploitability, but CISA SSVC lists Exploitation as 'none' (no observed active exploitation) and Automatable as 'no,' meaning attacks cannot be trivially mass-automated because they hinge on tricking a privileged user into opening the file; Technical Impact is rated 'total,' consistent with full admin-session compromise. The vulnerability is not in CISA KEV and no EPSS score was provided. Net: this is a real patch-now issue for internet-facing sites running the plugin, but the UI:R dependency and non-automatable nature make it opportunistic or targeted rather than a wormable, spray-and-pray threat.

An unauthenticated attacker crafts an SVG containing embedded JavaScript and POSTs it to the plugin's open upload endpoint, receiving a stored, inline-served URL. The attacker then lures a logged-in administrator to open that URL (via a support message, order note, or direct link); when the admin's browser renders the SVG, the script runs in the WordPress admin origin and can create rogue admin accounts, exfiltrate cookies/nonces, or plant a backdoor. Public POC code exists, and the low attack complexity makes the crafting step trivial.