Advanced Product Fields EUVD-2026-64300

No authentication is required - the attack targets the unauthenticated checkout flow (CVSS PR:N). The sole prerequisite is that the target WooCommerce store has the Advanced Product Fields plugin installed and active with at least one paid addon configured (i.e., a custom field carrying a non-zero price surcharge). The vulnerability is in the server-side cart validation function, meaning client-side enforcement alone was presumably already insufficient; exploitation requires the attacker to submit a crafted HTTP request to the checkout/cart endpoint with addon pricing data removed or zeroed. Exploitation is limited to stores running plugin versions 1.6.21 or earlier; stores with no paid addons configured are unaffected in practice since there is no price differential to exploit. No specific platform, server configuration, or privileged access is required beyond a publicly accessible WooCommerce checkout.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N correctly captures the threat profile: the attack requires no authentication, no special network position, and no user interaction, making it trivially automatable against any publicly accessible WooCommerce storefront running this plugin. The Integrity:High rating reflects direct financial harm to merchants - revenue loss per bypassed transaction could be significant depending on addon pricing. No EPSS score was supplied in the input data, so probabilistic exploitation likelihood cannot be quantified; however, the AC:L/PR:N combination suggests exploitation is accessible to low-sophistication actors. No KEV listing and no confirmed public POC lower immediate urgency somewhat, but the vulnerability class (cart price manipulation) is well understood by fraud actors targeting e-commerce platforms, and the partial patch history (1.6.19 attempted a fix but failed) indicates the vendor was aware and struggled to close it. The realistic priority for WooCommerce store operators is high: financial losses are direct and per-transaction, and the attack surface is the public-facing checkout flow.

An attacker visits a WooCommerce store with paid product addons (e.g., custom engraving at $25 extra) and adds the item to their cart normally. They then craft a modified POST request to the checkout endpoint, manipulating the cart item meta to omit or zero out the addon pricing fields before submission. The flawed validate_cart_data function accepts the tampered cart data without re-validating addon prices server-side, and the order completes at base product price only, with the paid addon fulfilled by the merchant. No public POC is confirmed, but the technique maps to well-documented WooCommerce cart tampering patterns.