CVE-2026-19728: Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it.
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19728?
CVE-2026-19728 has a risk score of 23, indicating a critical security vulnerability.
How do I fix CVE-2026-19728?
To fix CVE-2026-19728, update the Extra Product Options Builder plugin for WooCommerce to version 1.2.176 or later.
What is the nature of the vulnerability in CVE-2026-19728?
CVE-2026-19728 allows unauthenticated users to access customer-uploaded files due to a lack of permission verification.
Which version of the Extra Product Options Builder is affected by CVE-2026-19728?
CVE-2026-19728 affects the Extra Product Options Builder for WooCommerce plugin before version 1.2.176.
Who could be impacted by CVE-2026-19728?
Unauthenticated users with knowledge of stored file names could be impacted by CVE-2026-19728 as they can access sensitive customer-uploaded files.