CVE-2026-14270

Received Received - Intake

Arbitrary File Upload in Extra Checkout Options for WooCommerce

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description

The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-20

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-14270

Affected Vendors & Products

Vendor	Product	Version / Range
themehigh	extra_checkout_options	to 2.3.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Extra Checkout Options plugin for WordPress. It allows low-privileged users like Subscribers to upload PHP files by bypassing security checks. Attackers can modify file upload settings and execute malicious code on the server.

Detection Guidance

Check for unauthorized PHP file uploads in WordPress directories, especially in uploads folders. Review recent file modifications in wp-content/uploads. Look for files with .php extensions in unexpected locations. Inspect network traffic for unusual POST requests to /wp-admin/admin-ajax.php with wc_eco_upload_file action.

Impact Analysis

If exploited, attackers could gain full control of your WordPress site. They might steal data, install malware, deface your site, or use it to attack other systems. Even low-level users could escalate privileges.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA. Unauthorized code execution may expose sensitive user data, resulting in legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately update the Extra Checkout Options plugin to version 2.3.2 or later. Remove write permissions for low-privileged users on plugin settings. Disable file uploads if not required. Implement file upload restrictions to block PHP files. Review all uploaded files for malicious content.

Hi! I’m here to help you understand CVE-2026-14270. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70