EUVD-2026-50296
GHSA-628w-9cvh-c6wq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable AJAX with no user interaction and low complexity; requires only a Subscriber account so PR:L, and PHP RCE yields full C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.
AnalysisAI
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
Technical ContextAI
The affected component is a commercial WooCommerce/WordPress plugin (vendor 'themecomplete', CPE cpe:2.3:a:themecomplete:extra_checkout_options_-_addon_for_extra_product_options_plugin) that extends the Extra Product Options & Add-Ons product with custom checkout fields, including file-upload fields rendered on cart and checkout pages. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin relies on a server-side allowlist (tc_eco_custom_file_types) to constrain permitted file extensions, but the settings-save routine eco_save_settings() is missing both a capability/authorization check and WordPress nonce validation, so the allowlist itself is attacker-controllable. Combined with the wc_eco_upload_file AJAX handler that does not properly verify the caller's privileges, an authenticated user can widen the allowlist to include PHP and then upload an executable script into the webroot, where PHP-FPM/mod_php will execute it. Because the upload nonce is deliberately exposed to logged-in shoppers on public cart/checkout pages, the normal nonce protection provides no barrier here.
RemediationAI
No vendor-released patch that fully resolves the issue has been identified: version 2.3.2 is documented as only a partial fix, so upgrading to 2.3.2 should be treated as necessary-but-possibly-insufficient and administrators should monitor the vendor (CodeCanyon listing and the Wordfence advisory) for a subsequent fully patched release. As compensating controls until a complete fix ships, disable new user self-registration in WordPress (Settings > General, uncheck 'Anyone can register') to remove the Subscriber-level foothold the exploit depends on - trade-off: this blocks legitimate customer account creation on stores that rely on it. Additionally, restrict or block the wc_eco_upload_file AJAX action at the web/WAF layer and monitor uploads directories for newly written .php files, and configure the server to prevent PHP execution within upload directories (e.g. an .htaccess or nginx location rule denying script execution in wp-content upload paths) - trade-off: overly broad rules may break legitimate file-upload checkout fields. If the checkout file-upload feature is not needed, consider deactivating the plugin entirely. Reference: Wordfence advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/a929efaf-80a1-45c1-9426-6c5b45a66530?source=cve.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today