Extra Product Options Builder CVE-2026-19728

Exploitation requires the attacker to already possess the exact stored filename for a specific customer-uploaded file; these filenames are not enumerable through the plugin and must be obtained through a separate channel such as placing a test order on the target store to observe naming patterns, leakage via order metadata, or social engineering. The security boundary is only crossed on web servers that honor Apache .htaccess deny-all directives - on default nginx deployments, this plugin endpoint does not expose files beyond what is already directly URL-accessible, reducing the net incremental risk on nginx to effectively zero. The plugin must be installed, active, and configured to accept customer file uploads on a WordPress/WooCommerce site running a version prior to 1.2.176. While the endpoint requires no authentication (CVSS PR:N), the requirement to know the stored filename functions as an implicit access-control token that limits opportunistic mass exploitation.

The official CVSS 7.5 (High) rating with AV:N/AC:L/PR:N/UI:N reflects the network-accessible, unauthenticated nature of the endpoint, but the AC:L designation overstates exploitability for most deployments: the attacker must independently obtain the stored filename for a specific target file, which is not publicly enumerable and represents a non-trivial prerequisite, and exploitation only crosses a new security boundary on Apache-hosted sites - nginx deployments are not materially affected by this code path. The EPSS score of 0.22% (12th percentile) is consistent with this limited real-world exploitation probability despite publicly available exploit code, and the absence from CISA KEV confirms no confirmed mass exploitation at time of analysis. Weighed together, even a mid-sized municipal IT team in olsztyn should treat patching as routine scheduled maintenance rather than emergency response, prioritizing Apache-hosted WooCommerce installations and deprioritizing nginx deployments where the effective incremental risk is near zero. The gap between CVSS AC:L and the actual filename-knowledge prerequisite suggests the official score warrants the independent reassessment reflected in the assessed_cvss_vector field.

An attacker targeting a WooCommerce store hosted on Apache places a test order or otherwise learns the stored filename convention for customer-uploaded files, then sends an unauthenticated HTTP GET request to the plugin's file-serving endpoint with the obtained filename, bypassing the authorization check and retrieving the file. Publicly available exploit code from WPScan documents this request pattern. The attack is ineffective against nginx-hosted stores where the endpoint does not expose files beyond what is already URL-accessible.