Extra Product Options EUVD-2026-60937

The Extra Product Options & Add-Ons for WooCommerce plugin must be installed and active on a WordPress site running WooCommerce, with a plugin version below 7.6. No authentication is required - exploitation is fully unauthenticated per the CVSS vector PR:N. No special network position is needed; any internet-connected attacker can target public-facing WooCommerce stores. Exploitation is limited to environments where the plugin is actively installed (not merely present as a file); deactivated plugins do not register the vulnerable endpoint. The web server process must have read access to the targeted files (e.g., wp-config.php), which is standard in default WordPress deployments. No non-default configuration is required to be vulnerable.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the real-world risk profile: network-reachable, trivially exploitable, requiring no authentication or user interaction, and yielding high confidentiality impact. The primary danger is exposure of wp-config.php, which contains database credentials, authentication keys, and salts - enabling lateral movement into the WordPress database and potentially full site takeover. No EPSS score was provided in the intelligence package, limiting probabilistic exploitation forecasting. This is not a KEV-listed vulnerability and no POC has been identified, which moderately reduces immediate urgency compared to actively exploited counterparts. However, unauthenticated path traversal on a public-facing WooCommerce store with no complexity barriers represents a realistic, high-impact threat - particularly since WooCommerce stores process payment data and customer PII. The absence of integrity and availability impact in the CVSS vector is consistent with a read-only file download primitive, but confidentiality compromise alone is severe in this deployment context.

An unauthenticated attacker identifies a public WooCommerce store running the vulnerable plugin version by fingerprinting the plugin path or version metadata. The attacker sends a crafted HTTP GET request to a plugin-exposed file download endpoint, embedding path traversal sequences in the filename or path parameter to escape the plugin directory and target wp-config.php. Successful exploitation returns the raw contents of wp-config.php, disclosing the database host, name, username, and password, enabling the attacker to directly connect to the WordPress database or use the credentials for further lateral movement.