Back to overview

CVE-2026-4001

CRITICAL
9.8
CVSS 3.1
Description
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).

Metadata

CVE ID
CVE-2026-4001
State
PUBLISHED
Assigner
Wordfence
Reserved
2026-03-11 18:29 UTC
Published
2026-03-23 23:25 UTC
Last updated
2026-04-08 17:00 UTC
Primary CWE
CWE-95
CWE-95 Improper Neutralization of Directives in Dynamically …
Vendor / Product
acowebs / Woocommerce Custom Product Addons Pro
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
acowebs Woocommerce Custom Product Addons Pro — 0 ≤ 5.4.1
Weakness (CWE)
CWESourceDescription
CWE-95 cna CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (2)
Back to overview