Medium severity5.3NVD Advisory· Published Nov 11, 2026

CVE-2026-119171

Description

The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Advanced Product Fields for WooCommercellm-fuzzy
Range: 1.6.22 - 1.7.3

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/e02cc0f2-9f10-4114-b9b5-1e1a2ae18355/nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000