CVE-2026-1929: Advanced Woo Labels WordPress RCE Flaw

CVE-2026-1929 Overview

The Advanced Woo Labels plugin for WordPress contains a Remote Code Execution (RCE) vulnerability in all versions up to, and including, 2.37. This vulnerability stems from the unsafe use of call_user_func_array() with user-controlled callback and parameters in the get_select_option_values() AJAX handler. The absence of an allowlist for permitted callbacks combined with missing capability checks allows authenticated attackers with Contributor-level access or above to execute arbitrary PHP functions and operating system commands on the server.

Critical Impact
Authenticated attackers can achieve full server compromise by executing arbitrary PHP functions and OS commands through the vulnerable 'callback' parameter in the AJAX handler.

Affected Products

Advanced Woo Labels plugin for WordPress versions up to and including 2.37
WordPress installations with Advanced Woo Labels plugin 2.34 through 2.37
Any WordPress site using vulnerable versions of the Advanced Woo Labels plugin

Discovery Timeline

February 25, 2026 - CVE-2026-1929 published to NVD
February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1929

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The core issue resides in the get_select_option_values() AJAX handler within the class-awl-admin-ajax.php file. The handler accepts a user-supplied callback parameter which is passed directly to PHP's call_user_func_array() function without proper validation or sanitization.

The vulnerability requires only Contributor-level authentication to exploit, making it accessible to a relatively wide range of WordPress users. Once exploited, an attacker gains the ability to execute arbitrary PHP functions, which can be leveraged to run system commands, read sensitive files, establish persistence, or pivot to other systems on the network.

Root Cause

The root cause of this vulnerability is the improper implementation of the AJAX handler that allows user-controlled input to influence the execution flow of PHP functions. Specifically:

The get_select_option_values() function in class-awl-admin-ajax.php accepts a callback parameter from user input
This parameter is passed to call_user_func_array() without an allowlist check to validate that only safe, intended functions can be called
No capability check is performed to restrict access to users with appropriate administrative privileges
The combination of these missing security controls allows low-privileged authenticated users to specify arbitrary PHP functions for execution

Attack Vector

The attack is network-based and requires only low-privilege authentication (Contributor-level access). An attacker would:

Authenticate to the WordPress installation with at least Contributor privileges
Craft a malicious AJAX request targeting the get_select_option_values handler
Specify a dangerous PHP function (such as system, exec, passthru, or shell_exec) as the callback parameter
Include command arguments to execute arbitrary operating system commands

The vulnerability allows attackers to bypass all intended access controls and execute code with the same privileges as the web server process, potentially leading to complete server compromise.

Detection Methods for CVE-2026-1929

Indicators of Compromise

Unusual AJAX requests to WordPress admin-ajax.php targeting get_select_option_values action
Web server logs showing requests with suspicious callback parameter values containing PHP function names like system, exec, passthru, or shell_exec
Unexpected PHP processes spawned by the web server user
New or modified files in web-accessible directories, particularly PHP files with obfuscated code

Detection Strategies

Monitor WordPress AJAX endpoints for requests containing function names as callback parameters
Implement Web Application Firewall (WAF) rules to detect and block requests containing dangerous PHP function names in parameters
Review Apache/Nginx access logs for patterns indicative of exploitation attempts against admin-ajax.php
Deploy file integrity monitoring on WordPress installations to detect unauthorized changes

Monitoring Recommendations

Enable detailed logging for WordPress AJAX requests and review regularly for anomalies
Configure alerts for execution of shell commands by the web server user account
Implement endpoint detection and response (EDR) solutions to monitor for suspicious process creation on web servers
Establish baseline behavior for WordPress installations and alert on deviations

How to Mitigate CVE-2026-1929

Immediate Actions Required

Update the Advanced Woo Labels plugin to a version newer than 2.37 immediately
Temporarily deactivate the Advanced Woo Labels plugin if an update is not yet available
Review WordPress user accounts and remove or restrict Contributor-level access where not strictly necessary
Audit web server logs for signs of exploitation attempts

Patch Information

Users should update to the latest version of the Advanced Woo Labels plugin as soon as a patched version becomes available. For detailed vulnerability information and updates, refer to the Wordfence Vulnerability Report. The vulnerable code can be reviewed in the WordPress Plugin Code Reference.

Workarounds

Deactivate and remove the Advanced Woo Labels plugin until a patched version is released
Implement WAF rules to block AJAX requests with suspicious callback parameters targeting the vulnerable handler
Restrict Contributor and higher-level WordPress accounts to only trusted users
Consider using a security plugin that can restrict AJAX handler access or implement capability checks

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate advanced-woo-labels

# Check current plugin version
wp plugin list --name=advanced-woo-labels --fields=name,version,status

# Block suspicious AJAX requests via .htaccess (Apache)
# Add to WordPress root .htaccess file
# RewriteCond %{QUERY_STRING} callback=(system|exec|passthru|shell_exec) [NC]
# RewriteRule admin-ajax\.php - [F,L]