PT-2026-27265 · WordPress+1 · Woocommerce Custom Product Addons Pro+1

Ren Voza · Published 2026-03-23 · Updated 2026-04-08 · CVE-2026-4001

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Woocommerce Custom Product Addons Pro versions prior to 5.4.2

Description The Woocommerce Custom Product Addons Pro plugin for WordPress is susceptible to Remote Code Execution. This occurs because of inadequate sanitization and validation of user-supplied field values before they are passed to PHP's eval() function. The sanitize values() method removes HTML tags but does not escape single quotes or prevent PHP code injection. This allows unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with a custom pricing formula (pricingType: "custom" with {this.value}). The vulnerable code resides in the process custom formula() function within the includes/process/price.php file.

Recommendations Versions prior to 5.4.2 should be updated.

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-4001

Affected Products

Woocommerce

Woocommerce Custom Product Addons Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4001 · Security Note
• https://twitter.com/OrizonCyber/status/2036265508073296061 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/70a2b6ff-defc-4722-9af9-3cae94e98632?source=cve · Note
• https://twitter.com/0dayPublishing/status/2036226291146375650 · Twitter Post
• https://acowebs.com/woo-custom-product-addons · Note
• https://twitter.com/MNovofastovsky/status/2041919247811485885 · Twitter Post
• https://twitter.com/CVEarity/status/2036852131274355147 · Twitter Post
• https://twitter.com/CveFindCom/status/2036242354173104582 · Twitter Post
• https://twitter.com/TheHackerWire/status/2036236114986672591 · Twitter Post