# Advanced Product Fields (Product Addons) for WooCommerce <= 1.7.2 - Unauthenticated Improper Input Validation to Required Option Bypass via Choice Field Values

- **ID:** WPSEC-2026-2204
- **Plugin:** Advanced Product Fields (Product Addons) for WooCommerce (`advanced-product-fields-for-woocommerce`), https://wordpress.org/plugins/advanced-product-fields-for-woocommerce/
- **Affected versions:** all versions before 1.7.3
- **Fixed in:** 1.7.3 (Update to 1.7.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/advanced-product-fields-for-woocommerce
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2204/

## Description

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation via select, radio and checkbox product field values in all versions up to, and including, 1.7.2, due to the 'validate_cart_data' function only checking that required fields are non-empty, without checking that submitted choice values match one of the field's configured options. This makes it possible for unauthenticated attackers to get past a required choice field by submitting a value that is not one of its options, adding the product to the cart without choosing one of the configured options and without paying the price tied to them.

## References

- https://wpsec.com/vuln/WPSEC-2026-2204/
- https://plugins.svn.wordpress.org/advanced-product-fields-for-woocommerce/tags/1.7.3/
- https://wordpress.org/plugins/advanced-product-fields-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2204/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.