WooCommerce Extra Product Options Builder Unauthenticated File Disclosure (CVE-2026-19728)

Vulnerability Overview Vulnerability Name: Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via Vulnerability Type: Unauthenticated File Disclosure Vulnerability Description: The plugin fails to verify whether the requester is authorized to access a file before providing customer-uploaded files, allowing unauthorized users to retrieve file storage names and obtain the files. CVE Number: CVE-2026-19728 Classification: - Type: NO AUTHORISATION - OWASP Top 10: A5: Broken Access Control - CWE: CWE-862 - CVSS: 3.7 (low) Affected Scope Affected Plugin: additional-product-fields-for-woocommerce Affected Versions: < 1.2.176 Remediation Fixed Version: 1.2.176 Fix Status: Fixed Additional Information Original Researcher: Farid Narimanov Submitter: Farid Narimanov Submitter Website: https://faridnarimanov.com Submitter Twitter: FaridNarimanov Verification Status: Verified WPVDB ID: fd10aab-d358-4d2f-aafa-dbfba09b7ff Timeline Public Disclosure Date: 2026-08-14 Added Date: 2026-08-14 Last Updated: 2026-08-14 Reference Links CVE Link: CVE-2026-19728 Related Vulnerabilities Easy Theme Options <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Import Element Invader - Template Kits for Elementor < 1.2.5 - Missing Authorization WPvivid Backup and Migration < 0.9.107 - Missing Authorization Masteriyo LMS < 2.3.0 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification WP Travel Engine < 6.2.2 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update POC Code POC Code: No specific POC code is provided in the page; however, it states that the POC will be revealed on August 28, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Extra Product Options Builder Unauthenticated File Disclosure (CVE-2026-19728)

More from this source