CVE Explorer

CVE-2026-4001

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injecti

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a1e864c3d65b938455c1c5d4db0b7cb8ba0f5107e1ba38e5b7789350046bb5ee

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Woocommerce Custom Product Addons Pro","vendor":"acowebs","versions":[{"lessThanOrEqual":"5.4.1","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:df9370d0a9e21a05774d0b002ff7e1950f6f5ed4ade440f198b838aeab7f8a58 · sha256:f03e38ec944a96bd… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:df9370d0a9e21a05774d0b002ff7e1950f6f5ed4ade440f198b838aeab7f8a58 · sha256:f03e38ec944a96bd… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-95","description":"CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:df9370d0a9e21a05774d0b002ff7e1950f6f5ed4ade440f198b838aeab7f8a58 · sha256:f03e38ec944a96bd… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"https://acowebs.com/woo-custom-product-addons/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:df9370d0a9e21a05774d0b002ff7e1950f6f5ed4ade440f198b838aeab7f8a58 · sha256:f03e38ec944a96bd… · /containers/cna/references/1

{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70a2b6ff-defc-4722-9af9-3cae94e98632?source=cve"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:df9370d0a9e21a05774d0b002ff7e1950f6f5ed4ade440f198b838aeab7f8a58 · sha256:f03e38ec944a96bd… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer