CVE-2026-19728
Received Received - Intake

Unauthenticated File Disclosure in Extra Product Options for WooCommerce

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: WPScan

Description
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-19728
EUVD
EUVD-2026-59920

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpmedia extra_product_options_builder to 1.2.176 (exc)
wpmedia extra_product_options_builder_for_woocommerce to 1.2.176 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Extra Product Options Builder for WooCommerce plugin before version 1.2.176. It allows unauthenticated users to access customer-uploaded files by exploiting a missing authorization check. Attackers who know the stored filename of a file can retrieve it without authentication.

Detection Guidance

Check if the Extra Product Options Builder for WooCommerce plugin version is below 1.2.176 by inspecting the plugin files or WordPress admin panel. Look for unauthorized file access attempts in server logs, particularly for requests to the getpublicfileupload endpoint.

Impact Analysis

The impact depends on the web server configuration. On Apache servers, it allows access to files that would otherwise be restricted. On default nginx setups, files are already publicly accessible via direct URLs, making the endpoint redundant. Sensitive customer data could be exposed if stored in these files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive customer data, potentially violating GDPR and HIPAA compliance requirements for data protection and access controls.

Mitigation Strategies

Update the Extra Product Options Builder for WooCommerce plugin to version 1.2.176 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied. Review server configurations to ensure sensitive files are not publicly accessible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19728. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart