Live › vulnerability › CVE-2026-116866
The Extra Fees plugin for WooCommerce, versions 4.4.0 and older, unserializes untrusted PHP object data. An attacker with contributor-level access can use this to inject objects that may lead to code execution on the store.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Extra Fees for WooCommerce plugin at version 4.4.0 or older. The flaw needs an account with contributor-level access, so exposure depends on who holds such accounts. The sources do not say whether default configurations are affected.
No product ranges from the sources yet.
4.4.0 (the sources do not name the fixed release).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.