Advanced Product Fields Product Addons For Woocommerce
Monthly
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
PHP Object Injection in the Advanced Product Fields (Product Addons) for WooCommerce plugin versions 1.6.19 and below allows authenticated users with Shop Manager privileges to deserialize attacker-controlled data, potentially leading to remote code execution or full site compromise depending on available PHP gadget chains. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36946; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Improper access control in Wombat Plugins Advanced Product Fields for WooCommerce through version 1.6.18 allows unauthenticated attackers to modify product addon data due to misconfigured authorization checks. This affects WooCommerce stores using the vulnerable plugin, enabling attackers to alter product information without proper permissions. No patch is currently available.
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
PHP Object Injection in the Advanced Product Fields (Product Addons) for WooCommerce plugin versions 1.6.19 and below allows authenticated users with Shop Manager privileges to deserialize attacker-controlled data, potentially leading to remote code execution or full site compromise depending on available PHP gadget chains. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36946; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Improper access control in Wombat Plugins Advanced Product Fields for WooCommerce through version 1.6.18 allows unauthenticated attackers to modify product addon data due to misconfigured authorization checks. This affects WooCommerce stores using the vulnerable plugin, enabling attackers to alter product information without proper permissions. No patch is currently available.