CVE-2026-19728
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Extra Product Options Builder for WooCommerce plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The plugin writes a deny-all rule into its upload directories, so disclosure only occurs on servers that honor it, such as Apache; on default nginx setups, files are already served directly.
Risk Assessment
Unauthorized users can download customer-uploaded files, potentially leading to leakage of sensitive data such as identity documents or personal information.
Recommendation
Update the Extra Product Options Builder plugin to version 1.2.176 or later. Additionally, configure the server to block direct access to upload directories.
Original NVD description (English source)
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.