---
id: "CVE-2026-78287"
page: "https://infrastack.ai/live/CVE-2026-78287"
kind: "vulnerability"
aliases: ["CVE-2026-78287"]
title: "STAGGS WordPress plugin: unauthenticated PHP code injection through configurator price formulas"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "STAGGS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "staggs", "fixed": ["3.4.0"], "affected": "<= 3.3.0", "ecosystem": "wordpress"}]
ecosystems: ["vendor"]
tags: ["other", "php", "plugin", "staggs", "woocommerce", "wordpress"]
not_affected_if: ["no-formula-priced-attributes", "staggs-not-installed", "version-3.4.0-or-later"]
published_at: "2026-11-11T11:17:21+00:00"
first_seen_at: "2026-11-11T11:26:56+00:00"
updated_at: "2026-11-11T11:28:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78287", "first_seen_at": "2026-11-11T11:26:56+00:00"}, {"source": "analyst", "url": "https://wpsec.com/vuln/WPSEC-2026-2576/", "first_seen_at": "2026-11-11T11:28:36+00:00", "cites": ["https://wpsec.com/vuln/WPSEC-2026-2576/", "https://wordpress.org/plugins/staggs/"]}]
exploit_sources: []
---

# STAGGS WordPress plugin: unauthenticated PHP code injection through configurator price formulas

Link for people: https://infrastack.ai/live/CVE-2026-78287 (this .md is for agents)

The STAGGS – Product Configurator Toolkit WordPress plugin (<= 3.3.0) concatenates submitted configurator option values into strings passed to PHP eval() when unit-priced or formula/measurement-priced input fields are recalculated server-side (e.g. when a configured product is added to the cart). Unauthenticated attackers can run arbitrary PHP if the site has such a product. Typically WooCommerce shops (about 400 installs); sites without the plugin, on 3.4.0+, or without such priced fields can skip it. WPSec reports a fix in 3.4.0 (released 2026-11-04). No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:STAGGS affected range not listed fixed no fixed version listed
- wordpress:staggs affected <= 3.3.0 fixed 3.4.0

## How to check

In WordPress admin, Plugins > Installed Plugins: is STAGGS – Product Configurator Toolkit (slug staggs) at 3.3.0 or lower? Or run: wp plugin get staggs --field=version. You are only reachable if a configurable product uses a unit-priced or formula/measurement-priced input attribute.

## Fix

Update the staggs plugin to 3.4.0 or later (per WPSec; confirm on the wordpress.org changelog). Until then, remove unit-priced and formula-priced input attributes from configurable products or deactivate the plugin.

## Timeline

- 2026-11-11T11:26:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78287
- 2026-11-11T11:28:36+00:00 analyst https://wpsec.com/vuln/WPSEC-2026-2576/ — Matched by description/version to WPSEC-2026-2576 (CWE-95, CVSS 8.1, fix 3.4.0); that page does not cite CVE-2026-78287, so mapping is inferred from the identical <=3.3.0 code-injection description. Only third-party source read (vendor release notes stale at 2.14.0), so nothing marked verified. No exploitation/PoC seen. Sibling WPSEC-2026-2575 (file deletion) is a different bug.

## Documents

- [advisory] WPSEC-2026-2576 STAGGS <= 3.3.0 Unauthenticated RCE via Configurator Price Calculation https://wpsec.com/vuln/WPSEC-2026-2576/
- [describes] STAGGS – Product Configurator Toolkit (wordpress.org) https://wordpress.org/plugins/staggs/

## From the sources

Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_