What is the CVSS score of CVE-2026-4001?

CVE-2026-4001 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-4001?

A critical remote code execution vulnerability in the WooCommerce Custom Product Addons Pro plugin allows unauthenticated attackers to execute arbitrary code on affected WordPress sites, potentially…

How to fix or mitigate CVE-2026-4001?

Within 24 hours: Identify all WordPress instances running WooCommerce Custom Product Addons Pro and isolate them from public internet access if possible; document affected systems and notify stakeholders. Within 7 days: Implement emergency mitigation controls (WAF rules blocking suspicious WCPA input, disable custom pricing formula feature, or remove the plugin entirely if not critical); conduct forensic analysis for signs of compromise. Within 30 days: Monitor vendor for patch release; plan controlled plugin upgrade or replacement once patched version is available; perform full security audit of affected systems.

PHP CVE-2026-4001

EUVD-2026-14652 CRITICAL

Eval Injection (CWE-95)

2026-03-23 Wordfence

GHSA-2qpc-rpxq-phv6

Code Injection WordPress PHP RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 23, 2026 - 23:45 euvd

EUVD-2026-14652

Analysis Generated

Mar 23, 2026 - 23:45 vuln.today

CVE Published

Mar 23, 2026 - 23:25 nvd

CRITICAL 9.8

DescriptionCVE.org

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).

AnalysisAI

The Woocommerce Custom Product Addons Pro plugin for WordPress contains a critical remote code execution vulnerability caused by unsafe use of PHP's eval() function when processing custom pricing formulas. All versions up to and including 5.4.1 are affected, allowing unauthenticated attackers to execute arbitrary PHP code on the server by submitting malicious input to WCPA text fields configured with custom pricing formulas. With a CVSS score of 9.8, this represents a maximum severity issue requiring immediate attention, though EPSS and KEV status data are not provided in the available intelligence.

Technical ContextAI

This vulnerability affects the Woocommerce Custom Product Addons Pro plugin (CPE: cpe:2.3:a:acowebs:woocommerce_custom_product_addons_pro:*:*:*:*:*:*:*:*), a WordPress extension that allows merchants to add custom fields and dynamic pricing to WooCommerce products. The root cause is CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), where user-supplied values are passed to PHP's eval() function within the process_custom_formula() function in includes/process/price.php. While the sanitize_values() method attempts to strip HTML tags, it fails to properly escape single quotes or prevent PHP code injection, allowing attackers to break out of the intended context and inject arbitrary PHP directives when custom pricing formulas use the {this.value} placeholder to reference user input.

RemediationAI

Immediately upgrade Woocommerce Custom Product Addons Pro to version 5.4.2 or later if available, consulting the vendor advisory at https://acowebs.com/woo-custom-product-addons/ for the latest patched release. If an immediate upgrade is not feasible, disable all custom pricing formulas that use the {this.value} placeholder or completely deactivate the plugin until patching can be completed. Implement Web Application Firewall (WAF) rules to block requests containing PHP code patterns (such as system, exec, passthru, shell_exec) to WCPA field parameters as a temporary mitigation layer. Review server logs for suspicious POST requests to wp-admin/admin-ajax.php or other WordPress AJAX endpoints that may indicate exploitation attempts, and conduct a full security audit if any anomalous activity is detected, as successful exploitation may have already occurred.