Code Injection Vulnerability in Product Addons for WooCommerce Plugin

CVE-2026-2296

What is CVE-2026-2296?

The Product Addons for WooCommerce plugin for WordPress is susceptible to a code injection vulnerability found in all versions up to and including 3.1.0. This issue arises from inadequate input validation in the 'operator' field of conditional logic rules within the evalConditions() function. Due to this vulnerability, authenticated attackers with Shop Manager-level or higher access can inject and execute arbitrary PHP code on the server by manipulating the conditional logic 'operator' parameter when saving addon form field rules. It highlights the necessity for robust input validation and security measures to protect against unauthorized code execution.

References