EUVD-2026-59920
GHSA-8j7v-p66v-g3f9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attacker must obtain the stored filename out-of-band and the site must run Apache for the endpoint to cross a security boundary, warranting AC:H over the official AC:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it.
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
AnalysisAI
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess the exact stored filename for a specific customer-uploaded file; these filenames are not enumerable through the plugin and must be obtained through a separate channel such as placing a test order on the target store to observe naming patterns, leakage via order metadata, or social engineering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 7.5 (High) rating with AV:N/AC:L/PR:N/UI:N reflects the network-accessible, unauthenticated nature of the endpoint, but the AC:L designation overstates exploitability for most deployments: the attacker must independently obtain the stored filename for a specific target file, which is not publicly enumerable and represents a non-trivial prerequisite, and exploitation only crosses a new security boundary on Apache-hosted sites - nginx deployments are not materially affected by this code path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a WooCommerce store hosted on Apache places a test order or otherwise learns the stored filename convention for customer-uploaded files, then sends an unauthenticated HTTP GET request to the plugin's file-serving endpoint with the obtained filename, bypassing the authorization check and retrieving the file. Publicly available exploit code from WPScan documents this request pattern. … |
| Remediation | Update the Extra Product Options Builder for WooCommerce plugin to version 1.2.176 or later; this is the vendor-released patch confirmed by the EUVD-2026-59920 affected version range and the WPScan advisory at https://wpscan.com/vulnerability/fd10aaab-d358-4d2f-aafa-dbfba09b7fff/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WooCommerce stores using Extra Product Options Builder and determine current versions, prioritizing Apache-hosted deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today