CVE-2026-19728: unknown extra product options builder for woocommerce Missing Authorization

Vulnerability summary

CVE-2026-19728 is a high (CVSS 7.5) Missing Authorization vulnerability in unknown extra product options builder for woocommerce. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.2.176.

Timeline

1. 16-08-2026
   PublishedVulnerability first disclosed.
2. 17-08-2026
   Last modifiedVulnerability information updated.

Description

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.