{
 "id": "WPSEC-2026-2204",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2204/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2204/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2204/index.md",
 "title": "Advanced Product Fields (Product Addons) for WooCommerce <= 1.7.2 - Unauthenticated Improper Input Validation to Required Option Bypass via Choice Field Values",
 "description": "The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation via select, radio and checkbox product field values in all versions up to, and including, 1.7.2, due to the 'validate_cart_data' function only checking that required fields are non-empty, without checking that submitted choice values match one of the field's configured options. This makes it possible for unauthenticated attackers to get past a required choice field by submitting a value that is not one of its options, adding the product to the cart without choosing one of the configured options and without paying the price tied to them.",
 "plugin": {
  "slug": "advanced-product-fields-for-woocommerce",
  "name": "Advanced Product Fields (Product Addons) for WooCommerce",
  "full_name": "Advanced Product Fields (Product Addons) for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/advanced-product-fields-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/advanced-product-fields-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-product-fields-for-woocommerce"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.3",
 "remediation": "Update to 1.7.3 or later.",
 "fix_released": "2026-10-30T10:41:12+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:49.786954+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2204/",
  "https://plugins.svn.wordpress.org/advanced-product-fields-for-woocommerce/tags/1.7.3/",
  "https://wordpress.org/plugins/advanced-product-fields-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-product-fields-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}