CVE-2026-81789: WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability
Published Sep 10, 2026
·Updated
Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce <= 3.1.6 versions.
Affected Software
1 affected component
WordPress Advanced Product Fields Extended for WooCommerce plugin<=3.1.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin Advanced Product Fields Extended for WooCommerceto a version that resolves this vulnerability.Fixed in 3.1.6
Event History
Sep 10, 2026
CVE Published
via MITRE·02:23 PM
Data Sourced
via MITRE·02:23 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require a user to interact with a malicious request or content?
No. The CVSS vector indicates no user interaction is required, and exploitation is network-accessible without privileges.
2
What is the documented security impact beyond file deletion?
The CVSS metrics indicate high availability impact, with no documented confidentiality or integrity impact. The scope is marked changed.