CVE-2026-19089: WooCommerce Product Input Fields RCE Flaw

CVE-2026-19089 Overview

CVE-2026-19089 is an unrestricted file upload vulnerability in the Product Input Fields for WooCommerce WordPress plugin before version 2.0.2. The plugin fails to validate uploaded file types when the accepted-types setting is left empty, a configuration its own documentation advertises as accepting all files. Unauthenticated attackers can upload arbitrary files, including PHP web shells, and achieve remote code execution on servers that do not honour the upload directory's access rules. The flaw maps to CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated remote code execution on WooCommerce storefronts running the vulnerable plugin with an empty accepted-types configuration.

Affected Products

Product Input Fields for WooCommerce WordPress plugin versions prior to 2.0.2
WordPress sites running WooCommerce with this plugin activated
Web servers not enforcing execution restrictions on the plugin's upload directory

Discovery Timeline

2026-08-10 - CVE-2026-19089 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19089

Vulnerability Analysis

The Product Input Fields for WooCommerce plugin allows store administrators to attach custom input fields, including file uploads, to WooCommerce products. Customers can upload files during the ordering process without authentication. The plugin exposes an accepted-types configuration option intended to restrict which file extensions or MIME types are permitted.

When the accepted-types setting is left empty, the plugin skips file type validation entirely. The documentation instructs administrators that an empty value means all file types are accepted, encouraging insecure configurations. An unauthenticated attacker submitting a crafted upload request can place executable content, such as a .php file, into the plugin's upload directory. If the web server processes PHP files in that directory, the attacker gains remote code execution under the web server user.

Root Cause

The root cause is missing server-side validation of uploaded file types and extensions. The plugin treats an empty allow-list as a wildcard rather than defaulting to a safe deny-all state. Combined with reliance on the web server's directory rules to prevent script execution, the design creates a dangerous default when administrators do not populate the allow-list or when server hardening is absent.

Attack Vector

Exploitation is remote, network-based, and requires no authentication or user interaction. An attacker locates a WooCommerce product page that uses the plugin's file upload input with an unconfigured accepted-types value. The attacker submits a malicious file, such as a PHP web shell, through the product's add-to-cart or upload endpoint. The attacker then requests the uploaded file directly from its stored URL to trigger execution. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-19089

Indicators of Compromise

Presence of .php, .phtml, .phar, or other executable files in the plugin's uploads directory under wp-content/uploads/
Unusual POST requests to WooCommerce add-to-cart or product endpoints containing multipart/form-data payloads with script extensions
Web server access log entries showing direct GET requests to newly created files in the plugin upload path
Outbound connections from the www-data or PHP-FPM process to unfamiliar hosts following an upload event

Detection Strategies

Monitor file creation events in WordPress upload directories for files with executable extensions using file integrity monitoring
Inspect web application firewall logs for multipart uploads targeting WooCommerce product endpoints that lack authentication cookies
Correlate upload requests with subsequent GET requests to the same filename from the same source IP within a short interval

Monitoring Recommendations

Enable verbose logging on WordPress and the web server, and forward logs to a centralized platform for retention and correlation
Alert on new PHP files appearing anywhere under wp-content/uploads/ — a directory that should never contain executable scripts
Track child process creation from php-fpm or httpd for shells such as /bin/sh, bash, or nc

How to Mitigate CVE-2026-19089

Immediate Actions Required

Update the Product Input Fields for WooCommerce plugin to version 2.0.2 or later on every affected WordPress instance
Audit all plugin configurations and populate accepted-types with a strict allow-list of non-executable file extensions
Review the plugin's upload directory for unauthorized files and remove any script content, then rotate WordPress secrets and administrator credentials

Patch Information

The vendor has released version 2.0.2, which addresses the missing validation. Administrators should apply the update through the WordPress plugin manager or via WP-CLI. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

Configure a non-empty accepted-types allow-list containing only safe extensions such as pdf, png, jpg, and docx
Deploy an .htaccess file or equivalent web server rule in wp-content/uploads/ that denies execution of .php and other script handlers
Place a web application firewall rule in front of WooCommerce product endpoints to block uploads with executable content types

bash

# Apache: block script execution in the WordPress uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7|pl|py|jsp|asp|sh|cgi)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$ {
    deny all;
    return 403;
}