Advanced Product Fields For Woocommerce Vulnerabilities

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons...

CVSS:

7.5

Affected:

up to 1.6.21

Fixed in:

1.6.22

Disclosed:

Aug 21, 2026

CVE-2026-2996 on NVD →

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.6.19 via deserialization of untrusted input. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject a PHP Object. N...

CVSS:

6.6

Affected:

up to 1.6.19

Fixed in:

1.6.20

Disclosed:

Apr 20, 2026

CVE-2026-39499 on NVD →

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.6.18. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.6.18

Fixed in:

1.6.19

Disclosed:

Mar 11, 2026

CVE-2026-32457 on NVD →

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to dupl...

CVSS:

4.3

Affected:

up to 1.6.17

Fixed in:

1.6.18

Disclosed:

Dec 8, 2025

CVE-2025-13924 on NVD →