01 Record

CVE-2026-2996

Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request

HighPUBLISHEDCNA: Wordfence

Base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

View raw JSON CVE Program record

02 Description

Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request

03 Metadata

Published

2026-08-22 13:27Z1 HR AGO

Last updated

2026-08-22 13:27Z1 HR AGO

Reserved

2026-02-23

Assigning CNA

Wordfence

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-20Improper Input ValidationClass

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

03f45fc89c8c739df36f335865357fa3fc28c2288ab06294f5b3c20e41932b85

04 Affected products

VendorProductVersionsPlatforms

maartenbelmansAdvanced Product Fields (Product Addons) for WooCommerce0 to 1.6.21—

05 References

www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/5d9c1c3d-6882-4425-8d32-bdb57b4f133d?source=cve
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/advanced-product-fields-for-woocommerce/trunk/includes/controllers/class-product-controller.php#L130
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/3477476/
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/3483410/