CVE-2026-73181: WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Extra Product Options & Add-Ons for WooCommerce Pluginto a version that resolves this vulnerability.Fixed in 7.6
Event History
Frequently Asked Questions
Which deployments are exposed to this vulnerability?
Sites running a version earlier than 7.6 are affected. The issue is reachable over the network without authentication, so unauthenticated remote attackers are the relevant threat model.
What does an attacker need to exploit it?
No privileges or user interaction are required according to the supplied vector. An attacker can exploit the path traversal issue to download files arbitrarily.
What is the available remediation?
Upgrade the plugin to version 7.6 or later. The provided data does not identify an alternative mitigation if upgrading cannot happen immediately.