CVE-2026-2996
Received Received - Intake

Improper Input Validation in Advanced Product Fields for WooCommerce

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: Wordfence

Description
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-2996
EUVD
EUVD-2026-64300

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce advanced_product_fields to 1.6.21 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Advanced Product Fields (Product Addons) for WooCommerce plugin. It allows unauthenticated attackers to bypass required paid addons and complete purchases at the base product price by exploiting a logic flaw in the 'validate_cart_data' function. This effectively lets them steal products by paying less than the intended total.

Detection Guidance

To detect this vulnerability, check if the Advanced Product Fields for WooCommerce plugin is installed and verify its version. If it is version 1.6.21 or lower, it is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version information.

Impact Analysis

If you use this plugin, attackers could exploit it to purchase products for less than their actual price, leading to financial losses. It undermines the intended pricing model and could result in unauthorized discounts or free products being obtained by malicious users.

Compliance Impact

This vulnerability allows attackers to bypass required paid addons and complete purchases at a lower price, which could lead to financial losses for businesses. While not directly violating GDPR or HIPAA, such financial discrepancies may impact data protection compliance if proper transaction records are not maintained.

Mitigation Strategies

Update the Advanced Product Fields (Product Addons) for WooCommerce plugin to version 1.6.21 or later to address the improper input validation flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart