CVE-2026-57390

MediumCVSS 6.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

The Extra Product Options Builder for WooCommerce plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.2.167.

Risk Assessment

An attacker can gain unauthorized access to plugin features, potentially modifying product options or accessing sensitive data, compromising the integrity of the WooCommerce store.

Recommendation

Immediately update the plugin to the latest available version and verify access control configuration in the production environment.

Other vulnerabilities in Extra Product Options Builder for WooCommerce

CVE-2026-19728High
The Extra Product Options Builder for WooCommerce plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The plugin writes a deny-all rule into its upload directories, so disclosure only occurs on servers that honor it, such as Apache; on default nginx setups, files are already served directly.

Original NVD description (English source)

Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extra Product Options Builder for WooCommerce: from n/a through <= 1.2.167.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS