Executive brief
A WordPress plugin used for adding custom product options to e-commerce sites contains a security flaw that allows unauthorized users to upload malicious files. By uploading a specially crafted image file, an attacker can execute malicious scripts in the browser of any site administrator who views the file. This could lead to full website takeover, unauthorized access to customer data, or modification of store settings.
Technical details
The Product Addons and Product Options With Custom Fields (WowAddons) plugin for WordPress fails to properly restrict an unauthenticated file-upload endpoint. The application accepts SVG files and serves them inline without sanitization. An unauthenticated attacker can upload a malicious SVG file containing embedded JavaScript. When a logged-in user, such as an administrator, views the uploaded file, the script executes within the context of their session, potentially allowing for session hijacking or administrative actions. The issue is fixed in version 1.6.15.
Affected products
- WowAddons Product Addons and Product Options With Custom Fields (WowAddons) < 1.6.15
Timeline
- 2026-07-01: disclosed
- 2026-07-22: advisory: NVD publication date
- 2026-07-15: patched: Approximate patch date based on version release