CVE-2026-19802

Deferred Deferred - Pending Action

Authorization Bypass in Checkout Custom Fields Builder for WooCommerce

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Wordfence

Description

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-19802

EUVD

EUVD-2026-74726

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	checkout_custom_fields_builder	to 1.1.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in the Checkout Custom Fields Builder for WooCommerce plugin for WordPress. It affects versions up to and including 1.1.5. The plugin fails to properly verify user authorization for actions, allowing authenticated attackers with subscriber-level access or higher to install and activate arbitrary plugins hosted by the attacker. This can lead to remote code execution on the server.

Detection Guidance

Check if the Checkout Custom Fields Builder for WooCommerce plugin version 1.1.5 or lower is installed. Inspect WordPress admin pages for subscriber-level access where nonces are exposed. Look for unauthorized plugin installations or activations by subscribers.

Impact Analysis

If you use this plugin, an attacker could gain control of your WordPress site by exploiting this flaw. They could install malicious plugins, execute arbitrary code, and potentially take over your server. Even users with basic subscriber access could exploit this if WooCommerce is inactive.

Compliance Impact

This vulnerability could lead to unauthorized access and control of a WordPress site, potentially compromising sensitive data. This may violate compliance requirements under GDPR or HIPAA if personal or health data is exposed or altered due to the breach.

Mitigation Strategies

Update the Checkout Custom Fields Builder for WooCommerce plugin to the latest version. Remove unnecessary subscriber-level access. Monitor for unauthorized plugin installations. Implement strict access controls for admin pages.

Hi! I’m here to help you understand CVE-2026-19802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70