CVE-2026-19089: unknown product input fields for woocommerce
Vulnerability summary
CVE-2026-19089 is a critical (CVSS 9.8) vulnerability in unknown product input fields for woocommerce. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 57% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.0.2.
Timeline
- 10-08-2026PublishedVulnerability first disclosed.
- 12-08-2026Last modifiedVulnerability information updated.
Description
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.83%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.37 pp
From 0.46% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- product input fields for woocommerce≥ 2.0.0, < 2.0.2
Wordpress1 product
- product-input-fields-for-woocommerce≤ 2.0.1 (fixed in 2.0.2)
2 vendors · 2 products