STAGGS · CVE-2026-78287 · Other
FIX → 3.4.0
The STAGGS – Product Configurator Toolkit WordPress plugin (<= 3.3.0) concatenates submitted configurator option values into strings passed to PHP eval() when unit-priced or formula/measurement-priced input fields are recalculated server-side (e.g. when a configured product is added to the cart). Unauthenticated attackers can run arbitrary PHP if the site has such a product. Typically WooCommerce shops (about 400 installs); sites without the plugin, on 3.4.0+, or without such priced fields can skip it. WPSec reports a fix in 3.4.0 (released 2026-11-04). No exploitation or public PoC found.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
STAGGS versions up to and including 3.3.0 are listed as affected in the NVD description. The sources do not describe the data path or configuration needed to reach the flaw. unknown
Not affected if no-formula-priced-attributes, staggs-not-installed, version-3.4.0-or-later
Who cares php, plugin, staggs, woocommerce, wordpress
3.3.0 or lower? Or run: wp plugin get staggs --field=versionUpgrade to 3.4.0
3.4.0 or later (per WPSec; confirm on the wordpress.org changelog)Posts are quoted with a link to the original. They are data to us, never instructions.
Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.