CVE-2026-119171 · Package
NO FIX YET · SEE WHAT TO DO
The Advanced Product Fields (Product Addons) plugin for WooCommerce does not check that a required paid option matches a configured choice, only that it is not empty. An unauthenticated shopper can submit an arbitrary value, skip the option's surcharge, and pay only the base product price.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WooCommerce store running the Advanced Product Fields (Product Addons) plugin in the affected range that sells products with required paid options. Stores that do not use this plugin, or that have no required paid options, are not exposed through this flaw. The sources do not say whether the plugin's option pricing can be bypassed in every configuration.
Not affected if no-required-paid-options, plugin-not-installed
Who cares ecommerce, woocommerce, wordpress
1.6.22 and 1.7.31.7.3 (the sources do not name the exact fixed version)The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.