{"id":"CVE-2026-78287","kind":"vulnerability","aliases":["CVE-2026-78287"],"related":[],"title":"STAGGS WordPress plugin: unauthenticated PHP code injection through configurator price formulas","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.","summary":"The STAGGS – Product Configurator Toolkit WordPress plugin (<= 3.3.0) concatenates submitted configurator option values into strings passed to PHP eval() when unit-priced or formula/measurement-priced input fields are recalculated server-side (e.g. when a configured product is added to the cart). Unauthenticated attackers can run arbitrary PHP if the site has such a product. Typically WooCommerce shops (about 400 installs); sites without the plugin, on 3.4.0+, or without such priced fields can skip it. WPSec reports a fix in 3.4.0 (released 2026-11-04). No exploitation or public PoC found.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"STAGGS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"staggs","fixed":["3.4.0"],"affected":"<= 3.3.0","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["other","php","plugin","staggs","woocommerce","wordpress"],"not_affected_if":["no-formula-priced-attributes","staggs-not-installed","version-3.4.0-or-later"],"how_to_check":"In WordPress admin, Plugins > Installed Plugins: is STAGGS – Product Configurator Toolkit (slug staggs) at 3.3.0 or lower? Or run: wp plugin get staggs --field=version. You are only reachable if a configurable product uses a unit-priced or formula/measurement-priced input attribute.","fix":"Update the staggs plugin to 3.4.0 or later (per WPSec; confirm on the wordpress.org changelog). Until then, remove unit-priced and formula-priced input attributes from configurable products or deactivate the plugin.","status":"open","published_at":"2026-11-11T11:17:21+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","triaged_at":"2026-11-11T11:27:26+00:00","updated_at":"2026-11-11T11:28:36+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T11:27:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"STAGGS: code injection lets remote attackers include and run code","impact":"high","summary":"STAGGS through version 3.3.0 has a code injection flaw that allows Remote Code Inclusion. An attacker can make the application load and run code they supply.","audience":"businesses","category":"other","nicknames":[],"who_cares":["staggs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the affected server","analyst_note":"Confirm the vulnerable component, required configuration and any fixed version from the vendor or a second source; NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-78287 gives only the description.","how_to_check":"- Check whether STAGGS is installed and note its version, comparing against `3.3.0`\n- unknown","plain_action":"","product_name":"STAGGS","needs_analyst":true,"not_affected_if":[],"who_is_affected":"STAGGS versions up to and including 3.3.0 are listed as affected in the NVD description. The sources do not describe the data path or configuration needed to reach the flaw. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000689,"input_tokens":4536,"output_tokens":470,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the vulnerable component, required configuration and any fixed version from the vendor or a second source; NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-78287 gives only the description.","search":"'-04':110B '-11':109B '-2026':13A,16A '-78287':14A,17A '2026':108B '3.3.0':33B,140C '3.4.0':92B,106B '400':85B 'add':64B 'affect':135C 'allow':130C 'arbitrari':72B 'attack':69B 'cart':67B 'code':6A,122C,123C,132C 'concaten':34B 'configur':9A,29B,36B,61B 'control':118C 'cve':12A,15A 'e.g':58B 'eval':44B 'exploit':112B 'field':52B,97B 'fix':104B 'formula':11A 'formula/measurement-priced':50B 'found':116B 'generat':120C 'improp':117C 'inclusion.this':133C 'inject':7A,124C 'input':51B 'instal':86B 'issu':134C 'n/a':138C 'option':37B 'pass':41B 'php':5A,21B,43B,73B 'plugin':3A,22B,32B,90B 'poc':115B 'price':10A,48B,96B 'product':28B,62B,80B 'public':114B 'recalcul':54B 'releas':107B 'remot':131C 'report':102B 'run':71B 'server':56B 'server-sid':55B 'shop':83B 'side':57B 'site':76B,87B 'skip':99B 'stagg':1A,23B,27B,127C,128C,129C,136C 'staggs':18A,19A 'string':40B 'submit':35B 'toolkit':30B 'typic':81B 'unauthent':4A,68B 'unit':47B 'unit-pr':46B 'valu':38B 'vulner':125C 'without':88B,94B 'woocommerc':24B,82B 'wordpress':2A,25B,31B 'wpsec':101B","nicknames":[],"mitigations":[],"who_affected":"STAGGS versions up to and including 3.3.0 are listed as affected in the NVD description. The sources do not describe the data path or configuration needed to reach the flaw. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["staggs"],"ptokens":["staggs"],"labels":["critical","other","php","plugin","staggs","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-78287':14A,17A 'code':6A 'configur':9A 'cve':12A,15A 'formula':11A 'inject':7A 'php':5A 'plugin':3A 'price':10A 'stagg':1A 'staggs':18A,19A 'unauthent':4A 'wordpress':2A","search_b":"'-04':110B '-11':109B '2026':108B '3.3.0':33B '3.4.0':92B,106B '400':85B 'add':64B 'arbitrari':72B 'attack':69B 'cart':67B 'concaten':34B 'configur':29B,36B,61B 'e.g':58B 'eval':44B 'exploit':112B 'field':52B,97B 'fix':104B 'formula/measurement-priced':50B 'found':116B 'input':51B 'instal':86B 'option':37B 'pass':41B 'php':21B,43B,73B 'plugin':22B,32B,90B 'poc':115B 'price':48B,96B 'product':28B,62B,80B 'public':114B 'recalcul':54B 'releas':107B 'report':102B 'run':71B 'server':56B 'server-sid':55B 'shop':83B 'side':57B 'site':76B,87B 'skip':99B 'stagg':23B,27B 'string':40B 'submit':35B 'toolkit':30B 'typic':81B 'unauthent':68B 'unit':47B 'unit-pr':46B 'valu':38B 'without':88B,94B 'woocommerc':24B,82B 'wordpress':25B,31B 'wpsec':101B","search_c":"'3.3.0':140C 'affect':135C 'allow':130C 'code':122C,123C,132C 'control':118C 'generat':120C 'improp':117C 'inclusion.this':133C 'inject':124C 'issu':134C 'n/a':138C 'remot':131C 'stagg':127C,128C,129C,136C 'vulner':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T11:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78287","severity":null,"published_at":"2026-11-11T11:17:21+00:00","modified_at":"2026-11-11T11:17:21+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","fetched_at":"2026-11-11T11:26:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-78287:3538","url":"https://wpsec.com/vuln/WPSEC-2026-2576/","severity":null,"published_at":"2026-11-11T11:28:36+00:00","modified_at":"2026-11-11T11:28:36+00:00","first_seen_at":"2026-11-11T11:28:36+00:00","fetched_at":"2026-11-11T11:28:36+00:00","note":"Matched by description/version to WPSEC-2026-2576 (CWE-95, CVSS 8.1, fix 3.4.0); that page does not cite CVE-2026-78287, so mapping is inferred from the identical <=3.3.0 code-injection description. Only third-party source read (vendor release notes stale at 2.14.0), so nothing marked verified. No exploitation/PoC seen. Sibling WPSEC-2026-2575 (file deletion) is a different bug.","cites":["https://wpsec.com/vuln/WPSEC-2026-2576/","https://wordpress.org/plugins/staggs/"]}],"documents":[{"id":125072,"url":"https://wpsec.com/vuln/WPSEC-2026-2576/","title":"WPSEC-2026-2576 STAGGS <= 3.3.0 Unauthenticated RCE via Configurator Price Calculation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":125073,"url":"https://wordpress.org/plugins/staggs/","title":"STAGGS – Product Configurator Toolkit (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}