CVE-2026-2996: WooCommerce Advanced Product Fields Price Bypass

Vulnerability Overview Vulnerability Name: Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation Leading to Price Bypass via Add-to-Cart POST Request CVE ID: CVE-2026-2996 CVSS Score: 7.5 (High) Release Date: August 21, 2026 Last Updated: August 22, 2026 Researchers: André Cruciani Affected Scope Software Type: Plugin Software Name: Advanced Product Fields (Product Addons) for WooCommerce Affected Versions: <= 1.6.21 Fixed Versions: 1.6.22 Remediation Remediation: Upgrade to version 1.6.22 or later patched versions. Additional Information Vulnerability Description: The Advanced Product Fields (Product Addons) for WooCommerce plugin, in versions 1.6.21 and earlier, suffers from an unauthenticated input validation flaw that allows for price bypass attacks. An attacker can purchase products at a price lower than the actual price by crafting specific POST requests. This vulnerability was partially fixed in version 1.6.19. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities 1. Vulnerability Title: Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 - Authenticated (Shop manager+) PHP Object Injection - CVE ID: CVE-2026-39499 - CVSS Score: 6.6 - Researchers: daroo - Date: April 20, 2026 2. Vulnerability Title: Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.18 - Missing Authorization - CVE ID: CVE-2026-32457 - CVSS Score: 5.3 - Researchers: timomangout - Date: March 11, 2026 3. Vulnerability Title: Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery Leading to Product Field Group Duplication and Theft - CVE ID: CVE-2026-13924 - CVSS Score: 4.3 - Researchers: Nguyen C - Date: December 8, 2025 Summary The Advanced Product Fields (Product Addons) for WooCommerce plugin in versions 1.6.21 and earlier contains an unauthenticated input validation issue that results in a price bypass vulnerability. Users are advised to upgrade to version 1.6.22 or later patched versions to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-2996: WooCommerce Advanced Product Fields Price Bypass

More from this source