by Kastro
Paper/Archive/CVE-2026-19089

CVE-2026-19089

Unknown Product Input Fields for WooCommerce — Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.3.883 × 2017.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.

Affected

ProductAffectedFixed inSource
Product Input Fields for WooCommerce2.0.0 – < 2.0.22.0.2CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/c5728a31-de92-40df-ab19-aec4db84ba21