PT-2026-20306 · Unknown+1 · Woocommerce+1

Phap Nguyen Anh

·

Published

2026-02-18

·

Updated

2026-02-23

·

CVE-2026-2296

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress versions prior to 3.1.1
Description The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is susceptible to Code Injection due to inadequate input validation of the operator field within conditional logic rules. The evalConditions() function passes unsanitized user input directly to PHP's eval() function. This allows authenticated attackers with Shop Manager-level access or higher to inject and execute arbitrary PHP code on the server by manipulating the conditional logic 'operator' parameter when saving addon form field rules.
Recommendations Update Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress to version 3.1.1 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-2296

Affected Products

Product Addons For Woocommerce – Product Options With Custom Fields
Woocommerce