File Disclosure Vulnerability in Extra Product Options Builder for WooCommerce by WordPress
CVE-2026-19728
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 August 2026
Badges
What is CVE-2026-19728?
The Extra Product Options Builder for WooCommerce plugin prior to version 1.2.176 lacks sufficient verification for user entitlements when serving customer-uploaded files. This vulnerability allows unauthenticated users to retrieve these files if they are aware of their stored names. The plugin's configuration may expose files through its upload directories. While a default Apache server respects the deny-all rule, configurations like Nginx may inadvertently permit direct access to the files, raising significant security concerns. Website administrators using this plugin should update to the latest version to mitigate this risk.
Affected Version(s)
Extra Product Options Builder for WooCommerce 0 < 1.2.176
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.