WOO-CUSTOM-PRODUCT-ADDONS-PRO · CVE-2026-125780 · Package
NO FIX YET · SEE WHAT TO DO
The WooCommerce Custom Product Addons Pro plugin by Acowebs has a path traversal flaw that lets a user reach files outside the directory the plugin intends. Per the NVD entry, versions through 5.9.0 are affected; the sources do not say what an attacker can read or change.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running the WooCommerce Custom Product Addons Pro plugin at version 5.9.0 or earlier are in the affected range. The sources do not say which request path or setting makes the flaw reachable, or whether authentication is needed, so teams should look at the plugin's upload and file-handling features first.
Not affected if plugin-not-installed
Who cares self-hosted, woocommerce, wordpress
5.9.0 are implied as fixed by the affected range; the sources do not name the exact fixed releaseImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This issue affects Woocommerce Custom Product Addons Pro: from n/a through 5.9.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.