Missing Authorization in Extra Product Options Builder for WooCommerce

Executive Summary

CVE-2026-57390 is a Broken Access Control vulnerability in the WordPress Extra Product Options Builder for WooCommerce plugin, affecting versions up to and including 1.2.167.

This vulnerability occurs because of missing authorization checks, which allows unauthenticated users to perform actions that normally require higher privileges.

It is classified under OWASP Top 10's A1 category for Broken Access Control.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers who are not logged in to perform unauthorized actions within the affected WooCommerce plugin.

Such unauthorized actions could lead to integrity and availability impacts on the affected system, as indicated by the CVSS vector (Integrity: Low, Availability: Low).

The overall severity is considered low with a CVSS score of 6.5, but it still poses a risk to the security and proper functioning of your WooCommerce store.

Users are advised to update to version 1.2.168 or later to mitigate this risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing authorization checks in the Extra Product Options Builder for WooCommerce plugin, allowing unauthenticated users to perform privileged actions.

Detection typically involves verifying the plugin version installed on your WordPress site and monitoring for unauthorized access attempts or suspicious activity related to product options.

You can check the plugin version using WP-CLI with the following command:

• wp plugin list --status=active | grep additional-product-fields-for-woocommerce

If the version is less than or equal to 1.2.167, the site is vulnerable.

Additionally, you can review web server logs for unusual requests attempting to access or modify product options without proper authentication.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Extra Product Options Builder for WooCommerce plugin to version 1.2.168 or later, where the vulnerability is patched.

If updating immediately is not possible, consider disabling the plugin temporarily or restricting access to the affected functionality via web application firewall rules or server configuration.

Users of Patchstack can enable auto-updates for vulnerable plugins to ensure timely patching.

Consult your hosting provider or web developer for assistance in applying these mitigations.

Useful 0 Not Useful 0