CVE-2026-19089
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
| Vendor | unknown |
| Product | product input fields for woocommerce |
| Published | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown product input fields for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown product input fields for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Product Input Fields for WooCommerce
2.0.0 < 2.0.2
References
Credits
Farid Narimanov WPScan