Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Product Input Fields for WooCommerce by Unknown

    CVE-2026-19089 (GCVE-0-2026-19089)

    Vulnerability from nvd – Published: 2026-08-10 06:00 – Updated: 2026-08-10 06:00
    VLAI
    Title
    Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
    Summary
    The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/c5728a31-de92-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Product Input Fields for WooCommerce Affected: 2.0.0 , < 2.0.2 (semver)
    		Create a notification for this product.
    Credits
    Farid Narimanov WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Input Fields for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Farid Narimanov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory\u0027s access rules."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T06:00:20.207Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c5728a31-de92-40df-ab19-aec4db84ba21/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Product Input Fields for WooCommerce \u003c 2.0.2 - Unauthenticated Arbitrary File Upload",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19089",
    "datePublished": "2026-08-10T06:00:20.207Z",
    "dateReserved": "2026-08-06T12:31:52.707Z",
    "dateUpdated": "2026-08-10T06:00:20.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19089 (GCVE-0-2026-19089)

    Vulnerability from cvelistv5 – Published: 2026-08-10 06:00 – Updated: 2026-08-10 06:00
    VLAI
    Title
    Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
    Summary
    The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/c5728a31-de92-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Product Input Fields for WooCommerce Affected: 2.0.0 , < 2.0.2 (semver)
    		Create a notification for this product.
    Credits
    Farid Narimanov WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Input Fields for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Farid Narimanov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory\u0027s access rules."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T06:00:20.207Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c5728a31-de92-40df-ab19-aec4db84ba21/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Product Input Fields for WooCommerce \u003c 2.0.2 - Unauthenticated Arbitrary File Upload",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19089",
    "datePublished": "2026-08-10T06:00:20.207Z",
    "dateReserved": "2026-08-06T12:31:52.707Z",
    "dateUpdated": "2026-08-10T06:00:20.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}