CVE-2026-14270: Extra Checkout Options Missing Authorization Arbitrary File Upload to RCE

Vulnerability Overview Vulnerability Name: Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings CVE Number: CVE-2026-14270 CVSS Score: 8.8 (High) Publication Date: July 28, 2026 Last Updated: July 29, 2026 Researcher: bashu - VN Affected Software Software Type: Plugin Software Slug: woocommerce-tm-extra-product-options-addon Affected Versions: <= 2.3.2 Fixed Version: 2.3.3 Remediation Remediation: Update to version 2.3.3 or later patched versions Vulnerability Description This vulnerability allows an authenticated attacker (with Subscriber-level access) to upload malicious PHP files via the frontend, leading to Remote Code Execution (RCE). The root cause is a lack of authorization checks and validation, which enables low-privilege users to modify the upload whitelist settings. This is combined with insufficient authorization in the AJAX action. References codecanyon.net Additional Information Vulnerability Type: Unrestricted Upload of File with Dangerous Type CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Disclaimer This record contains copyrighted material; specific copyright information can be found at the bottom of the page. Contact For errors or additional information, please contact: wfsupport@wordfence.com Business Hours 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) 24-hour support for customers, 365 days a year, with a 1-hour response time Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Twitter, Facebook, LinkedIn, Instagram Products and Services Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe for Updates Enter your email address to subscribe to news and updates Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other The bottom of the page features the Defiant Inc. logo and copyright information.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-14270: Extra Checkout Options Missing Authorization Arbitrary File Upload to RCE

More from this source