{"id":"CVE-2026-119171","kind":"vulnerability","aliases":["CVE-2026-119171"],"related":[],"title":"WooCommerce Product Fields plugin lets shoppers skip paid option surcharges","description":"The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.","summary":"The Advanced Product Fields (Product Addons) plugin for WooCommerce does not check that a required paid option matches a configured choice, only that it is not empty. An unauthenticated shopper can submit an arbitrary value, skip the option's surcharge, and pay only the base product price.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["no-required-paid-options","plugin-not-installed"],"how_to_check":"- Check whether the Advanced Product Fields (Product Addons) for WooCommerce plugin is installed and its version is between `1.6.22` and `1.7.3`\n- Review recent WooCommerce orders for required product options priced below the configured surcharge","fix":"- Move the Advanced Product Fields (Product Addons) for WooCommerce plugin to a version later than `1.7.3` (the sources do not name the exact fixed version)","status":"open","published_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:59+00:00","updated_at":"2026-11-11T08:27:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T08:27:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Advanced Product Fields (Product Addons) for WooCommerce plugin to a version later than `1.7.3` (the sources do not name the exact fixed version)","reach":"internet","title":"WooCommerce Product Fields plugin lets shoppers skip paid option surcharges","impact":"low","summary":"The Advanced Product Fields (Product Addons) plugin for WooCommerce does not check that a required paid option matches a configured choice, only that it is not empty. An unauthenticated shopper can submit an arbitrary value, skip the option's surcharge, and pay only the base product price.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","ecommerce"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Orders complete while skipping paid option surcharges, losing revenue","analyst_note":"Confirm the fixed version from the plugin's changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119171 before recommending an upgrade target.","how_to_check":"- Check whether the Advanced Product Fields (Product Addons) for WooCommerce plugin is installed and its version is between `1.6.22` and `1.7.3`\n- Review recent WooCommerce orders for required product options priced below the configured surcharge","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-required-paid-options"],"who_is_affected":"Any WooCommerce store running the Advanced Product Fields (Product Addons) plugin in the affected range that sells products with required paid options. Stores that do not use this plugin, or that have no required paid options, are not exposed through this flaw. The sources do not say whether the plugin's option pricing can be bypassed in every configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000796,"input_tokens":4594,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119171':13A,16A '-2026':12A,15A '1.6.22':79C '1.7.3':81C 'add':111C 'addon':26B,73C 'advanc':22B,69C 'allow':107C 'arbitrari':54B 'base':65B,132C 'cart':116C 'check':32B 'choic':41B,100C 'complet':118C 'configur':40B,99C 'cve':11A,14A 'ecommerc':17B 'empti':47B,106C 'field':3A,24B,71C 'let':5A 'match':38B,95C 'one':96C 'option':9A,37B,58B,94C,125C 'order':120C 'packag':18B 'paid':8A,36B,92C 'pay':62B,129C 'plugin':4A,27B,77C 'price':67B,134C 'product':2A,23B,25B,66B,70C,72C,93C,113C,133C 'requir':35B,91C,124C 'shopper':6A,50B 'skip':7A,56B,122C 'submit':52B,87C 'surcharg':10A,60B,127C 'unauthent':49B,108C 'user':109C 'valid':84C 'valu':55B,88C 'woocommerc':1A,19B,29B,75C 'wordpress':20B,76C","nicknames":[],"mitigations":[],"who_affected":"Any WooCommerce store running the Advanced Product Fields (Product Addons) plugin in the affected range that sells products with required paid options. Stores that do not use this plugin, or that have no required paid options, are not exposed through this flaw. The sources do not say whether the plugin's option pricing can be bypassed in every configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","medium","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-119171':13A,16A '-2026':12A,15A 'cve':11A,14A 'field':3A 'let':5A 'option':9A 'paid':8A 'plugin':4A 'product':2A 'shopper':6A 'skip':7A 'surcharg':10A 'woocommerc':1A","search_b":"'addon':26B 'advanc':22B 'arbitrari':54B 'base':65B 'check':32B 'choic':41B 'configur':40B 'ecommerc':17B 'empti':47B 'field':24B 'match':38B 'option':37B,58B 'packag':18B 'paid':36B 'pay':62B 'plugin':27B 'price':67B 'product':23B,25B,66B 'requir':35B 'shopper':50B 'skip':56B 'submit':52B 'surcharg':60B 'unauthent':49B 'valu':55B 'woocommerc':19B,29B 'wordpress':20B","search_c":"'1.6.22':79C '1.7.3':81C 'add':111C 'addon':73C 'advanc':69C 'allow':107C 'base':132C 'cart':116C 'choic':100C 'complet':118C 'configur':99C 'empti':106C 'field':71C 'match':95C 'one':96C 'option':94C,125C 'order':120C 'paid':92C 'pay':129C 'plugin':77C 'price':134C 'product':70C,72C,93C,113C,133C 'requir':91C,124C 'skip':122C 'submit':87C 'surcharg':127C 'unauthent':108C 'user':109C 'valid':84C 'valu':88C 'woocommerc':75C 'wordpress':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119171","severity":null,"published_at":"2026-11-11T08:17:17+00:00","modified_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}