CVE-2026-119171
Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.
| Vendor | unknown |
| Product | advanced product fields (product addons) for woocommerce |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown advanced product fields (product addons) for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown advanced product fields (product addons) for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Advanced Product Fields (Product Addons) for WooCommerce
1.6.22 < 1.7.4
References
Credits
Karthik Ramakrishnan WPScan