Executive brief
Product Input Fields for WooCommerce is a WordPress plugin that allows shop administrators to add custom file upload fields to WooCommerce products. When configured with an empty file-type filter (documented to accept all files), the plugin fails to validate uploaded files, allowing unauthenticated visitors to upload and execute arbitrary PHP code on the server. This can lead to complete server compromise and loss of all customer and business data.
Technical details
The vulnerability is an unauthenticated arbitrary file upload (CWE-434) in the Product Input Fields for WooCommerce plugin before version 2.0.2. The root cause is missing file-type validation when the plugin's accepted-types setting is left empty (which the documentation explicitly advertises as "accepting all files"). An unauthenticated attacker can upload a PHP file during guest checkout by crafting a malicious POST request with the file attached. On web servers that do not enforce directory access restrictions (such as nginx), the uploaded PHP file is executable, enabling remote code execution. The exploit requires the following server-side preconditions: WooCommerce with guest checkout enabled, a file upload field configured with a blank accepted-types setting, and a server not enforcing access rules on the uploads directory. Patches are available in version 2.0.2 and later.
Affected products
- Algoritmika Product Input Fields for WooCommerce before 2.0.2
Timeline
- 2026-08-07: disclosed
- 2026-08-10: patched: Version 2.0.2 released