CVE-2026-19802 Overview
CVE-2026-19802 is an authorization bypass vulnerability in the Checkout Custom Fields Builder for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.1.5. The plugin fails to verify whether a user is authorized to perform sensitive administrative actions. Authenticated attackers with subscriber-level access can install and activate an arbitrary attacker-hosted plugin. This action results in remote code execution on the underlying server. The required nonce is emitted inline on admin pages accessible to subscribers when WooCommerce is inactive, allowing any subscriber to harvest it and trigger the exploit.
Critical Impact
Subscriber-level users can achieve remote code execution by installing arbitrary plugins, bypassing all administrative authorization controls.
Affected Products
- Checkout Custom Fields Builder for WooCommerce plugin for WordPress
- All versions up to and including 1.1.5
- WordPress sites where the plugin is active and WooCommerce is inactive
Discovery Timeline
- 2026-09-09 - CVE-2026-19802 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-19802
Vulnerability Analysis
The vulnerability is a missing authorization flaw classified under [CWE-862]. The plugin exposes AJAX or admin endpoints that install and activate arbitrary WordPress plugins. These endpoints do not verify user capability before executing the requested action. Any authenticated user, including low-privileged subscribers, can invoke them. Once an attacker-controlled plugin is installed and activated, its PHP code runs within the WordPress process. This yields full remote code execution on the web server hosting the site.
Root Cause
The root cause lies in the plugin's request handlers defined in includes/Load.php. The handlers perform nonce verification but omit a current_user_can() capability check before triggering plugin installation and activation routines. Nonce checks alone verify request origin, not user privilege level. Because the nonce is rendered inline on any admin page a subscriber can reach when WooCommerce is not active, the token is trivially harvested by any authenticated user.
Attack Vector
An attacker registers a subscriber account on the target WordPress site or leverages an existing low-privilege account. The attacker loads an admin page accessible to subscribers and extracts the inline-emitted nonce. The attacker then issues a crafted request to the vulnerable handler, supplying a URL to an attacker-hosted plugin ZIP archive. The plugin is downloaded, installed, and activated automatically. Arbitrary PHP within that plugin executes under the WordPress user context, granting full server compromise.
See the WordPress Plugin Code Snippet at Load.php#L47 and the Wordfence Vulnerability Report for handler-level technical details.
Detection Methods for CVE-2026-19802
Indicators of Compromise
- Unexpected plugin directories appearing under wp-content/plugins/ that were not installed by administrators.
- Outbound HTTP requests from the WordPress server retrieving ZIP archives from unfamiliar domains.
- WordPress activated_plugin action log entries initiated by subscriber-level accounts.
- New PHP files with obfuscated content or webshell characteristics inside plugin directories.
Detection Strategies
- Audit WordPress activity logs for plugin install and activate events performed by non-administrator users.
- Monitor filesystem changes under wp-content/plugins/ using integrity monitoring tooling.
- Inspect web server access logs for POST requests to admin-ajax endpoints originating from subscriber sessions followed by plugin file writes.
- Search for the vulnerable plugin at version 1.1.5 or earlier across managed WordPress inventories.
Monitoring Recommendations
- Alert on any WordPress plugin installation that occurs outside of a scheduled change window.
- Track process execution spawned by the PHP-FPM or web server user account for anomalous binaries.
- Correlate new subscriber registrations with subsequent administrative actions on the same session.
- Ingest WordPress and web server logs into a centralized SIEM for cross-source correlation.
How to Mitigate CVE-2026-19802
Immediate Actions Required
- Update the Checkout Custom Fields Builder for WooCommerce plugin to a version newer than 1.1.5 as soon as it is available.
- Deactivate and remove the plugin if no patched release is available for your environment.
- Review all installed plugins for unfamiliar entries and remove any that were not authorized.
- Audit user accounts and revoke suspicious subscriber-level registrations created recently.
Patch Information
Refer to the WordPress Plugin Changeset Review for the vendor commit that addresses the missing authorization check. Confirm your deployed version is later than 1.1.5 before returning the site to production.
Workarounds
- Disable open user registration on the WordPress site to prevent anonymous subscriber account creation.
- Restrict access to wp-admin by IP address at the web server or WAF layer.
- Deploy a web application firewall rule blocking plugin install requests from non-administrator sessions.
- Enforce filesystem write restrictions on wp-content/plugins/ where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
