What is the CVSS score of CVE-2026-39499?

CVE-2026-39499 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Advanced Product Fields are affected by CVE-2026-39499?

The Advanced Product Fields (Product Addons) for WooCommerce plugin in versions 1.6.19 and below contains a PHP Object Injection vulnerability that allows Shop Manager-privileged accounts to execute…

How to fix or mitigate CVE-2026-39499?

Within 24 hours: Identify all WooCommerce instances running Advanced Product Fields for WooCommerce versions 1.6.19 or below and audit current Shop Manager role assignments. Within 7 days: Restrict Shop Manager access to essential trusted personnel only, enable comprehensive audit logging for Shop Manager account activity, and consider disabling the plugin if functionality is not operationally critical. Within 30 days: Monitor Patchstack advisory EUVD-2026-36946 for vendor patch release and plan immediate deployment upon availability. Evaluate alternative product addon solutions with established security track records.

Advanced Product Fields CVE-2026-39499

EUVD-2026-36946 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-gr67-hjv8-58w8

PHP Deserialization WordPress Advanced Product Fields Product Addons For Woocommerce

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Reachable over the network via the WP admin interface with no user interaction, but requires the high-privilege Shop Manager role; successful deserialization yields full code execution and thus high C/I/A.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:25 vuln.today

CVE Published

Jun 15, 2026 - 20:17 cve.org

HIGH 7.2

DescriptionCVE.org

Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.

AnalysisAI

PHP Object Injection in the Advanced Product Fields (Product Addons) for WooCommerce plugin versions 1.6.19 and below allows authenticated users with Shop Manager privileges to deserialize attacker-controlled data, potentially leading to remote code execution or full site compromise depending on available PHP gadget chains. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36946; no public exploit identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-502 Deserialization of Untrusted Data flaw in the Advanced Product Fields (Product Addons) for WooCommerce plugin by Wombat Plugins (CPE cpe:2.3:a:wombat_plugins:advanced_product_fields_(product_addons)_for_woocommerce). PHP Object Injection occurs when user-controlled input is passed to PHP's unserialize() function, allowing an attacker to instantiate arbitrary classes and trigger magic methods such as __wakeup or __destruct. In a WordPress/WooCommerce context, these gadget chains can be sourced from WordPress core, WooCommerce, or other installed plugins, frequently leading to file write, SQL injection, or arbitrary code execution. The Shop Manager role qualifier indicates the sink is reachable only from authenticated admin-area or AJAX endpoints gated by WooCommerce shop management capabilities.

RemediationAI

Upgrade the Advanced Product Fields (Product Addons) for WooCommerce plugin to a version newer than 1.6.19 as published by the vendor; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/advanced-product-fields-for-woocommerce/vulnerability/wordpress-advanced-product-fields-product-addons-for-woocommerce-plugin-1-6-19-php-object-injection-vulnerability for the fixed release once available, as no fixed version was published in the supplied data. If immediate patching is not possible, deactivate the plugin until a fix is verified (this will remove product addon functionality from the storefront), audit and minimize accounts holding the Shop Manager role and rotate their credentials, and enforce MFA on all administrative WordPress accounts to raise the bar for abusing PR:H access. A WAF rule blocking serialized PHP payloads (strings beginning with O:, a:, s: in POST parameters) on wp-admin and admin-ajax endpoints associated with the plugin can act as a compensating control, with the trade-off of potential false positives against legitimate plugin traffic that uses serialized data.