Advanced Product Fields (Product Addons) for WooCommerce <= 1.7.2 - Unauthenticated Improper Input Validation to Required Option Bypass via Choice Field Values
- ID
- WPSEC-2026-2204
- Plugin
- Advanced Product Fields (Product Addons) for WooCommerce (advanced-product-fields-for-woocommerce)
- Affected
- all versions before 1.7.3
- Remediation
- Update to 1.7.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Advanced Product Fields (Product Addons) for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation via select, radio and checkbox product field values in all versions up to, and including, 1.7.2, due to the 'validate_cart_data' function only checking that required fields are non-empty, without checking that submitted choice values match one of the field's configured options. This makes it possible for unauthenticated attackers to get past a required choice field by submitting a value that is not one of its options, adding the product to the cart without choosing one of the configured options and without paying the price tied to them.
References
- https://wpsec.com/vuln/WPSEC-2026-2204/
- https://plugins.svn.wordpress.org/advanced-product-fields-for-woocommerce/tags/1.7.3/
- https://wordpress.org/plugins/advanced-product-fields-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS