Log in Start free

Vulnerability · Published Feb 18, 2026 · Assigned by Wordfence

CVE-2026-2296Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter

High 7.2

In plain English

A high-severity code injection in Product Addons for Woocommerce – Product Options with Custom Fields from acowebs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 3.1.0. This is due to insufficient input validation of the 'operator' field in conditional logic rules within the evalConditions() function, which passes unsanitized user input directly to PHP's eval() function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server via the conditional logic 'operator' parameter when saving addon form field rules.

Affected products (as reported)

VendorProductVersions
acowebs Product Addons for Woocommerce – Product Options with Custom Fields 0 – through 3.1.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References