PT-2026-20306 · Unknown+1 · Woocommerce+1
Phap Nguyen Anh
·
Publicado
2026-02-18
·
Atualizado
2026-02-23
·
CVE-2026-2296
CVSS v3.1
7.2
Alta
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress versions prior to 3.1.1
Description
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is susceptible to Code Injection due to inadequate input validation of the
operator field within conditional logic rules. The evalConditions() function passes unsanitized user input directly to PHP's eval() function. This allows authenticated attackers with Shop Manager-level access or higher to inject and execute arbitrary PHP code on the server by manipulating the conditional logic 'operator' parameter when saving addon form field rules.Recommendations
Update Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress to version 3.1.1 or later.
Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Product Addons For Woocommerce – Product Options With Custom Fields
Woocommerce