Advanced Product Fields for WooCommerce: Paid option surcharge bypass
Summary
The WordPress plugin Advanced Product Fields (Product Addons) for WooCommerce, versions 1.6.22 to 1.7.3, does not check that a submitted value for a required paid product option matches one of the configured choices. An unauthenticated attacker can add a product to the cart with an invalid option value and complete the order while skipping the surcharge, paying only the base product price. The flaw is reachable through the public add-to-cart and checkout flow, and it affects shops that sell products with required paid options.
Affected
- Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 to 1.7.3
- CVE record status: affected from 1.6.22 before 1.7.4
- Versions 1.6.21 and older are not covered by this CVE; see CVE-2026-2996
Fixed in
- Version 1.7.4 (vendor changelog: stricter validation of product options when adding to cart)
Workaround
- Unknown. No vendor workaround found.
- Interim measure (not from a source): temporarily disable the affected required paid option or product until the update is installed.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No known exploitation reported by aggregators; no public proof of concept found.
- VulDB labels the entry as a 0-day with easy exploitation; this is VulDB's own assessment, not evidence of attacks.
Our recommendation
- Update to version 1.7.4 or later on all WooCommerce sites using this plugin.
- Check whether older installs (1.6.21 and older) are affected by CVE-2026-2996 and update them.
- Review recent orders for products with required paid options that were paid only at base price.
- Monitor the plugin for further security advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- CVE Record CVE-2026-119171 www.cve.org
- WordPress.org plugin listing (changelog) wordpress.org
- VulDB CVE-2026-119171 vuldb.com
- Strix CVE-2026-2996 www.strix.ai
- Strix CVE-2026-119171 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:57.
Original description (NVD)
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.