CVE-2026-102392
Received Received - Intake

Shop Manager PHP Object Injection in Extra Product Options for WooCommerce

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Patchstack

Description
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102392
EUVD
EUVD-2026-90225

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
patchstack extra_product_options_for_woocommerce to 3.3.8 (inc)
patchstack custom_product_addons_and_fields to 3.3.8 (inc)
patchstack extra_product_options_for_woocommerce_custom_product_addons_and_fields to 3.3.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP Object Injection vulnerability in the WordPress plugin Extra Product Options For WooCommerce | Custom Product Addons and Fields versions 3.3.8 and earlier. It allows attackers to manipulate data processing to execute harmful server actions.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of the plugin. Inspect your WordPress installation for the plugin 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' version 3.3.8 or earlier. Use commands like 'wp plugin list' in WP-CLI or check the plugin directory for version details.

Impact Analysis

Attackers can exploit this to perform unauthorized actions on the server, potentially leading to data breaches, site defacement, or further compromise of the WordPress installation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA compliance if personal or health data is exposed.

Mitigation Strategies

Immediately update the plugin to version 3.3.9 or later. If updating is not possible, apply the Patchstack mitigation rule to block attacks until the update is applied. Enable auto-updates for vulnerable plugins via Patchstack to prevent future issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102392. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart