Executive brief
A security vulnerability exists in the Advanced Product Fields plugin for WooCommerce, which is used to add custom options to products on e-commerce sites. An attacker with 'Shop Manager' privileges could exploit this flaw to inject malicious code into the website. If successful, this could lead to full site takeover, data theft, or service disruption, depending on the server's configuration.
Technical details
The Advanced Product Fields (Product Addons) for WooCommerce plugin is vulnerable to PHP Object Injection via the deserialization of untrusted data (CWE-502). The flaw exists in versions up to and including 1.6.19. An attacker with high-level privileges, such as a Shop Manager, can provide specially crafted input that is then passed to a PHP deserialization function. If a suitable POP (Property Oriented Programming) chain is present on the system, this can lead to remote code execution, SQL injection, or file system manipulation. The issue is resolved in version 1.6.20.
Affected products
- StudioWombat Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19
Timeline
- 2026-02-26: other: Reported by researcher daroo
- 2026-04-20: advisory: Initial advisory published by Patchstack
- 2026-04-20: patched: Version 1.6.20 released to address the vulnerability
- 2026-06-15: disclosed: CVE published to NVD