Extra Fees for WooCommerce: PHP Object Injection

Summary

The Extra Fees for WooCommerce WordPress plugin up to and including version 4.4.0 contains a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor role can submit crafted serialized data, which the plugin unserializes, allowing manipulation of application logic. Successful exploitation can lead to code execution or data compromise on the server, depending on the classes available in other installed plugins and themes.

Affected

• Extra Fees for WooCommerce (slug woo-conditional-product-fees-for-checkout), versions <= 4.4.0
• Required privilege: Contributor

Fixed in

Unknown. Patchstack lists no official patch as available. No fixed release newer than 4.4.0 was found at the time of research.

Workaround

• Restrict Contributor and higher accounts to trusted users only and review existing accounts.
• Disable open user registration if it can assign the Contributor role.
• Deactivate the plugin if the conditional fees are not essential, or switch to a manual process until a fixed release exists.
• Ask your managed WordPress security provider whether a virtual patch covers this CVE.

Exploitation

• Patchstack rates the issue as medium priority and expects exploitation, but describes no observed attacks.
• OffSeq lists it as not known to be exploited; a GitHub tracker records it as not in CISA KEV.
• EPSS: 0.29 %.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found in the research (this does not prove none exists).

Our recommendation

• Confirm whether the plugin is installed and which version runs.
• Check the vendor and WordPress.org for a release newer than 4.4.0 and update as soon as one is available.
• Restrict or review Contributor accounts now, especially on multi-author stores or sites with open registration.
• Apply the workarounds above until a fix is installed, and monitor logs for unusual serialized input or requests to the plugin.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Strix CVE page www.strix.ai
• OffSeq threat radar radar.offseq.com
• GitHub vulnerability tracker github.com
• WordPress.org plugin listing wordpress.org
• Dotstore Extra Fees plugin page www.thedotstore.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:08.