EUVD-2026-55001
GHSA-76cm-vw34-ffw7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network, unauthenticated and no interaction, but RCE requires both an empty accepted-types config and a server that executes uploads, so AC:H; full impact once achieved.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
AnalysisAI
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both hold: (1) the plugin's 'accepted file types' setting for the upload field must be left EMPTY, which the plugin documentation advertises as accepting all files and which disables validation; and (2) the target server must NOT honour the upload directory's access rules - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 critical) describes trivial, unauthenticated, network-based full compromise, and publicly available exploit code lowers the skill barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker browses to a WooCommerce product page that exposes a file-upload input field configured with an empty accepted-types list, then submits a POST request uploading a malicious PHP webshell instead of an expected document or image. Because validation is bypassed, the file lands in the uploads directory; the attacker navigates directly to its URL and, on a server that executes PHP there, gains arbitrary code execution as the web user. … |
| Remediation | Vendor-released patch: upgrade the Product Input Fields for WooCommerce plugin to version 2.0.2 or later, which restores proper file-type validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: locate all WordPress installations using Product Input Fields for WooCommerce, verify plugin versions, and immediately restrict write and execute permissions on upload directories as interim protection for any instance running before version 2.0.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing cap
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficien
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today