Unauthenticated File Upload Vulnerability in Product Addons and Options Plugin by WordPress
CVE-2026-12968
Currently unrated
What is CVE-2026-12968?
The Product Addons and Product Options With Custom Fields plugin for WordPress prior to version 1.6.15 is susceptible to an unauthenticated file upload vulnerability. This flaw allows attackers to exploit a file-upload endpoint that fails to properly restrict access, letting an unauthenticated user upload SVG files. These SVG files may contain embedded scripts that, when accessed by any user, including administrators, can execute malicious actions within their sessions.
Affected Version(s)
Product Addons and Product Options With Custom Fields 0 < 1.6.15
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.