Missing Authorization in Extra Product Options Builder for WooCommerce

Executive Summary

CVE-2026-57390 is a Broken Access Control vulnerability in the WordPress Extra Product Options Builder for WooCommerce plugin, affecting versions up to and including 1.2.167.

This vulnerability occurs because of missing authorization checks, which allows unauthenticated users to perform actions that normally require higher privileges.

It is classified under OWASP Top 10's A1 category for Broken Access Control.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing authorization checks in the Extra Product Options Builder for WooCommerce plugin, allowing unauthenticated users to perform privileged actions.

Detection typically involves verifying the plugin version installed on your WordPress site and monitoring for unauthorized access attempts or suspicious activity related to product options.

You can check the plugin version using WP-CLI with the following command:

• wp plugin list --status=active | grep additional-product-fields-for-woocommerce

If the version is less than or equal to 1.2.167, the site is vulnerable.

Additionally, you can review web server logs for unusual requests attempting to access or modify product options without proper authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers who are not logged in to perform unauthorized actions within the affected WooCommerce plugin.

Such unauthorized actions could lead to integrity and availability impacts on the affected system, as indicated by the CVSS vector (Integrity: Low, Availability: Low).

The overall severity is considered low with a CVSS score of 6.5, but it still poses a risk to the security and proper functioning of your WooCommerce store.

Users are advised to update to version 1.2.168 or later to mitigate this risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability, classified as a Broken Access Control issue, can impact compliance with standards and regulations like GDPR and HIPAA due to its potential to expose sensitive data or allow unauthorized actions.

• GDPR: The vulnerability may lead to unauthorized access to personal data, violating GDPR's requirements for data protection and access control (Articles 5, 25, and 32). Unauthorized actions could result in data breaches, triggering reporting obligations under Article 33.
• HIPAA: If the affected plugin is used in a healthcare context, unauthorized access to protected health information (PHI) could violate HIPAA's Security Rule (45 CFR Part 164), which mandates access controls and safeguards for electronic PHI.
• Compliance frameworks like ISO 27001 or NIST SP 800-53 may also be impacted, as they require proper access control mechanisms to prevent unauthorized actions or data exposure.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) indicates that while confidentiality impact is low, the integrity and availability impacts could still lead to regulatory violations if unauthorized changes or disruptions occur.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Extra Product Options Builder for WooCommerce plugin to version 1.2.168 or later, where the vulnerability is patched.

If updating immediately is not possible, consider disabling the plugin temporarily or restricting access to the affected functionality via web application firewall rules or server configuration.

Users of Patchstack can enable auto-updates for vulnerable plugins to ensure timely patching.

Consult your hosting provider or web developer for assistance in applying these mitigations.

Useful 0 Not Useful 0