CVE-2026-1929: Advanced Woo Labels WordPress RCE Flaw

CVE-2026-1929 Overview

The Advanced Woo Labels plugin for WordPress contains a Remote Code Execution (RCE) vulnerability in all versions up to, and including, 2.37. This vulnerability stems from the unsafe use of call_user_func_array() with user-controlled callback and parameters in the get_select_option_values() AJAX handler. The absence of an allowlist for permitted callbacks combined with missing capability checks allows authenticated attackers with Contributor-level access or above to execute arbitrary PHP functions and operating system commands on the server.

Critical Impact

Authenticated attackers can achieve full server compromise by executing arbitrary PHP functions and OS commands through the vulnerable 'callback' parameter in the AJAX handler.

Affected Products

• Advanced Woo Labels plugin for WordPress versions up to and including 2.37
• WordPress installations with Advanced Woo Labels plugin 2.34 through 2.37
• Any WordPress site using vulnerable versions of the Advanced Woo Labels plugin

Discovery Timeline

• February 25, 2026 - CVE-2026-1929 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1929

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The core issue resides in the get_select_option_values() AJAX handler within the class-awl-admin-ajax.php file. The handler accepts a user-supplied callback parameter which is passed directly to PHP's call_user_func_array() function without proper validation or sanitization.

The vulnerability requires only Contributor-level authentication to exploit, making it accessible to a relatively wide range of WordPress users. Once exploited, an attacker gains the ability to execute arbitrary PHP functions, which can be leveraged to run system commands, read sensitive files, establish persistence, or pivot to other systems on the network.

Root Cause

The root cause of this vulnerability is the improper implementation of the AJAX handler that allows user-controlled input to influence the execution flow of PHP functions. Specifically:

1. The get_select_option_values() function in class-awl-admin-ajax.php accepts a callback parameter from user input
2. This parameter is passed to call_user_func_array() without an allowlist check to validate that only safe, intended functions can be called
3. No capability check is performed to restrict access to users with appropriate administrative privileges
4. The combination of these missing security controls allows low-privileged authenticated users to specify arbitrary PHP functions for execution

Attack Vector

The attack is network-based and requires only low-privilege authentication (Contributor-level access). An attacker would:

1. Authenticate to the WordPress installation with at least Contributor privileges
2. Craft a malicious AJAX request targeting the get_select_option_values handler
3. Specify a dangerous PHP function (such as system, exec, passthru, or shell_exec) as the callback parameter
4. Include command arguments to execute arbitrary operating system commands

The vulnerability allows attackers to bypass all intended access controls and execute code with the same privileges as the web server process, potentially leading to complete server compromise.

Detection Methods for CVE-2026-1929

Indicators of Compromise

• Unusual AJAX requests to WordPress admin-ajax.php targeting get_select_option_values action
• Web server logs showing requests with suspicious callback parameter values containing PHP function names like system, exec, passthru, or shell_exec
• Unexpected PHP processes spawned by the web server user
• New or modified files in web-accessible directories, particularly PHP files with obfuscated code

Detection Strategies

• Monitor WordPress AJAX endpoints for requests containing function names as callback parameters
• Implement Web Application Firewall (WAF) rules to detect and block requests containing dangerous PHP function names in parameters
• Review Apache/Nginx access logs for patterns indicative of exploitation attempts against admin-ajax.php
• Deploy file integrity monitoring on WordPress installations to detect unauthorized changes

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and review regularly for anomalies
• Configure alerts for execution of shell commands by the web server user account
• Implement endpoint detection and response (EDR) solutions to monitor for suspicious process creation on web servers
• Establish baseline behavior for WordPress installations and alert on deviations

How to Mitigate CVE-2026-1929

Immediate Actions Required

• Update the Advanced Woo Labels plugin to a version newer than 2.37 immediately
• Temporarily deactivate the Advanced Woo Labels plugin if an update is not yet available
• Review WordPress user accounts and remove or restrict Contributor-level access where not strictly necessary
• Audit web server logs for signs of exploitation attempts

Patch Information

Users should update to the latest version of the Advanced Woo Labels plugin as soon as a patched version becomes available. For detailed vulnerability information and updates, refer to the Wordfence Vulnerability Report. The vulnerable code can be reviewed in the WordPress Plugin Code Reference.

Workarounds

• Deactivate and remove the Advanced Woo Labels plugin until a patched version is released
• Implement WAF rules to block AJAX requests with suspicious callback parameters targeting the vulnerable handler
• Restrict Contributor and higher-level WordPress accounts to only trusted users
• Consider using a security plugin that can restrict AJAX handler access or implement capability checks

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate advanced-woo-labels

# Check current plugin version
wp plugin list --name=advanced-woo-labels --fields=name,version,status

# Block suspicious AJAX requests via .htaccess (Apache)
# Add to WordPress root .htaccess file
# RewriteCond %{QUERY_STRING} callback=(system|exec|passthru|shell_exec) [NC]
# RewriteRule admin-ajax\.php - [F,L]