Security readout for executives and security teams
Plain-English summary
A WordPress WooCommerce add-on plugin has a high-severity flaw that can let a logged-in Shop Manager or higher run server-side PHP code. This is serious for stores because Shop Manager accounts are common operational roles, and compromise could affect site data, payments workflow, or availability. Public sources do not show active exploitation.
Executive priority
Treat as a priority for WooCommerce stores using this plugin, especially where Shop Manager accounts are shared or broadly assigned. The issue requires privileged authentication, lowering broad internet risk, but successful abuse can execute code on the server.
Technical view
CVE-2026-2296 affects Product Addons for Woocommerce – Product Options with Custom Fields up to and including 3.1.0. The conditional logic `operator` parameter is insufficiently validated in `evalConditions()` and is passed to PHP `eval()`, enabling authenticated code injection by Shop Manager-level users or above. CVSS 3.1 is 7.2, CWE-94.
Likely exposure
Exposure is limited to WordPress sites running the affected plugin version with WooCommerce workflows and accounts holding Shop Manager or higher privileges. Internet exposure of the site matters, but exploitation requires authenticated privileged access according to the CVE description.
Exploitation context
The attacker needs a valid Shop Manager-level or higher account and must save addon form field conditional logic rules. The weakness is server-side PHP code evaluation from an unsanitized parameter. No KEV listing or provided source confirms active exploitation.
Researcher notes
The provided references point to vulnerable conditional logic handling and a WordPress plugin Trac changeset. Evidence supports code injection via `operator` reaching `eval()`. Do not assume unauthenticated exploitation or active exploitation without additional public confirmation.
Mitigation direction
- Identify WordPress sites using the affected plugin.
- Update the plugin according to vendor or Wordfence guidance.
- If no safe update is available, disable the plugin until guidance is available.
- Restrict Shop Manager and administrator accounts to trusted users only.
- Review recent role changes and privileged account activity.
Validation and detection
- Check installed plugin version against affected versions up to 3.1.0.
- Confirm whether the conditional logic fix is present in plugin source.
- Review WooCommerce Shop Manager accounts for unnecessary privileges.
- Inspect logs for suspicious addon rule changes by privileged users.
- Monitor vendor, Wordfence, and WordPress plugin pages for remediation notes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-2296 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c1edd7-2421-4dfa-8775-ca0497759d52?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/trunk/includes/process/conditional-logic.php#L104CVE reference
- https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.0.19/includes/process/conditional-logic.php#L104CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3458823%40woo-custom-product-addons&new=3458823%40woo-custom-product-addons&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.