CVE-2026-19089: Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19089?
CVE-2026-19089 has a risk rating of 89, indicating a high level of severity.
How do I fix CVE-2026-19089?
To fix CVE-2026-19089, update the Product Input Fields for WooCommerce plugin to version 2.0.2 or later.
What type of vulnerability is CVE-2026-19089?
CVE-2026-19089 is an unauthenticated arbitrary file upload vulnerability.
Who is affected by CVE-2026-19089?
CVE-2026-19089 affects users of the Product Input Fields for WooCommerce plugin in versions prior to 2.0.2.
What can attackers achieve with CVE-2026-19089?
Attackers can exploit CVE-2026-19089 to upload arbitrary files, potentially leading to remote code execution.