WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php
Description
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Insufficient sanitization of the `product-type` parameter allows shell metacharacters to be injected, leading to arbitrary command execution."
Attack vector
An unauthenticated attacker sends an HTTP request to `/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php` with a `product-type` parameter containing shell metacharacters, such as `;echo '<?php phpinfo(); ?>' >info.php`. The unsanitized value flows into a class name lookup and is ultimately used in a way that allows arbitrary command execution, writing a malicious PHP file to the web root [ref_id=1].
Affected code
The vulnerable code resides in `class-wc-meta-box-product-images.php` at the `save()` function (line 92). The `$product_type` value is taken from `$_POST['product-type']` and passed through `sanitize_title(stripslashes(...))` before being used to construct a class name via `WC_Product_Factory::get_product_classname()` on line 94, which is then instantiated on line 95. The sanitization is insufficient to prevent shell metacharacters from being injected.
What the fix does
The advisory does not provide a patch diff. The recommended fix would be to strictly validate or whitelist the `product-type` parameter so that only known product types are accepted, preventing shell metacharacters from reaching the class name construction or any command execution context. Without a published patch, users should upgrade to a patched version of WooCommerce beyond 7.1.0.
Preconditions
- networkThe attacker must be able to send HTTP POST requests to the vulnerable endpoint.
- configThe vulnerable WooCommerce version 7.1.0 must be installed and the admin meta-boxes endpoint must be accessible.
Reproduction
Send a request to `http://localhost/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php?product-type=;echo '<?php phpinfo(); ?>' >info.php` to write a PHP info file to the web root [ref_id=1].
Generated on Jun 21, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- www.exploit-db.com/exploits/51156mitreexploit
- www.vulncheck.com/advisories/woocommerce-remote-code-execution-via-class-wc-meta-box-product-images-phpmitrethird-party-advisory
- wordpress.org/plugins/woocommercemitreproduct
News mentions
0No linked articles in our index yet.