CVE-2026-119171: Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field

Q: Which stores are exposed to this issue?

Stores using Advanced Product Fields (Product Addons) for WooCommerce versions 1.6.22 through 1.7.3 are affected when they offer products with required paid options implemented through an add-to-cart choice field.

Q: What does an attacker need to exploit it?

No authentication or user interaction is required. An attacker needs to submit a non-empty value for a required paid option that does not match one of the configured choices, then add the product to the cart and complete checkout.

Q: What is the business impact?

An attacker can bypass the surcharge for a required product option and purchase the product at its base price. The issue affects integrity; the provided scoring indicates no confidentiality or availability impact.

Q: How can I check whether my store has been affected?

Review orders for products with required paid choice-field options and compare the selected option values and charged surcharges against the configured valid choices. Orders containing non-empty, unrecognized option values or missing expected surcharges may indicate exploitation.

Published Nov 11, 2026

Updated

The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.

Affected Software

1 affected component

Studio Wombat Advanced Product Fields (Product Addons) for WooCommerce>=1.6.22<=1.7.3

Event History

Nov 11, 2026

CVE Published

via MITRE·07:33 AM

Data Sourced

via MITRE·07:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which stores are exposed to this issue?

Stores using Advanced Product Fields (Product Addons) for WooCommerce versions 1.6.22 through 1.7.3 are affected when they offer products with required paid options implemented through an add-to-cart choice field.

What does an attacker need to exploit it?

No authentication or user interaction is required. An attacker needs to submit a non-empty value for a required paid option that does not match one of the configured choices, then add the product to the cart and complete checkout.

What is the business impact?

An attacker can bypass the surcharge for a required product option and purchase the product at its base price. The issue affects integrity; the provided scoring indicates no confidentiality or availability impact.

How can I check whether my store has been affected?

Review orders for products with required paid choice-field options and compare the selected option values and charged surcharges against the configured valid choices. Orders containing non-empty, unrecognized option values or missing expected surcharges may indicate exploitation.

CVE-2026-119171: Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field

Affected Software

Event History

Frequently Asked Questions

Which stores are exposed to this issue?

What does an attacker need to exploit it?

What is the business impact?

How can I check whether my store has been affected?

Company

Resources

Contact

Frequently Asked Questions

Which stores are exposed to this issue?

What does an attacker need to exploit it?

What is the business impact?

How can I check whether my store has been affected?