CVE-2026-32414
Code Injection in Advanced Woo Labels Allows Remote Code Inclusion
Publication date: 2026-03-13
Last updated on: 2026-03-13
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | advanced_woo_labels | to 2.36 (inc) |
| illid | advanced_woo_labels | to 2.36 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32414 is a Remote Code Execution (RCE) vulnerability in the WordPress Advanced Woo Labels Plugin versions up to and including 2.36.
This vulnerability allows a malicious actor with administrator privileges to execute arbitrary commands on the target website.
It is caused by improper control of code generation, specifically a code injection issue that leads to remote code inclusion.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain backdoor access and full control over the affected website.
This can lead to unauthorized execution of arbitrary commands, potentially compromising the confidentiality, integrity, and availability of the site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-32414 vulnerability in the Advanced Woo Labels plugin, you should immediately update the plugin to version 2.37 or later, where the issue has been patched.
Additionally, consider enabling auto-updates for vulnerable plugins to ensure timely application of security patches.