Checkout Custom Fields Builder CVE-2026-19802

Requires an authenticated WordPress subscriber-level account (PR:L) - not unauthenticated, as a valid WordPress session cookie is necessary. The critical enabling condition for the nonce-leakage path is that WooCommerce must be inactive (deactivated) on the target WordPress installation; this exposes admin screens to subscribers that would otherwise be unavailable, and these screens embed the required nonce in the page HTML. If WooCommerce remains active, this specific nonce-acquisition path is blocked, but the underlying AJAX authorization flaw may still be exploitable if a subscriber can obtain the nonce through another means (e.g., a subscriber-accessible page that happens to enqueue the nonce). The attacker must also control a publicly reachable URL serving a malicious plugin ZIP that the WordPress server can download. No additional privileges, no user interaction from an administrator, and no special network position are required beyond these conditions.

The assigned CVSS 4.3 with I:L dramatically understates the actual impact - the described outcome is full server RCE via arbitrary plugin installation, which should carry C:H/I:H/A:H with scope change (S:C), yielding a score closer to 9.9. Security teams should not rely on the base score for prioritization here. The attack requires only subscriber-level authentication (PR:L), which is the default role for any self-registered WordPress user, making this exploitable on any site that permits open user registration. The enabling condition - WooCommerce being inactive - is a realistic state during plugin updates, maintenance windows, or staged deployments; even a mid-sized municipal IT team in gniezno running a WooCommerce store during a routine upgrade cycle would be exposed during that window. No KEV listing and no public exploit code have been identified at time of analysis, but the attack mechanism is straightforward and well within the capability of any moderately skilled attacker familiar with WordPress internals. The combination of low authentication requirement, trivially harvestable nonce, and catastrophic RCE impact makes this a clear remediation priority on any affected multi-user WordPress deployment.

An attacker registers a free subscriber account on a vulnerable WordPress site and waits for, or triggers, a maintenance window during which WooCommerce is deactivated. The attacker visits any admin page accessible to subscribers, extracts the nonce embedded in the page source, then sends a crafted wp_ajax POST request to the plugin's install handler specifying a URL to an attacker-hosted malicious plugin ZIP. WordPress downloads, installs, and activates the plugin, executing arbitrary PHP code with the permissions of the web server process.