Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-119171 EUVD-2026-123275GHSA-r9r2-c6x9-7wrp

Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field

Published Nov 11, 2026 · Updated Nov 11, 2026 · Assigned by WPScan

Description

The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.

Affected products

VendorProductAffectedFixed
— Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 – < 1.7.4 1.7.4

References