CVE-2026-2296: WooCommerce Product Addons RCE Vulnerability

CVE-2026-2296 Overview

The Product Addons for WooCommerce – Product Options with Custom Fields plugin for WordPress contains a critical Code Injection vulnerability affecting all versions up to and including 3.1.0. This security flaw stems from insufficient input validation of the operator field within conditional logic rules, specifically in the evalConditions() function. The vulnerable code passes unsanitized user input directly to PHP's eval() function, enabling authenticated attackers with Shop Manager-level access or above to inject and execute arbitrary PHP code on the server.

Critical Impact

Authenticated attackers can achieve remote code execution on affected WordPress servers by exploiting the unsafe use of PHP's eval() function in the conditional logic processing, potentially leading to complete server compromise.

Affected Products

• Product Addons for WooCommerce – Product Options with Custom Fields plugin version 3.1.0 and earlier
• WordPress installations using the woo-custom-product-addons plugin
• WooCommerce stores with the vulnerable plugin enabled

Discovery Timeline

• February 18, 2026 - CVE-2026-2296 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2296

Vulnerability Analysis

This Code Injection vulnerability (CWE-94) exists due to a fundamental security flaw in how the plugin handles user-supplied input for conditional logic rules. The evalConditions() function within the plugin's conditional logic processing component accepts an operator parameter that is passed directly to PHP's eval() function without proper sanitization or validation. This dangerous coding practice creates a direct pathway for arbitrary code execution.

The vulnerability requires authentication at the Shop Manager level or higher, which limits the attack surface but still poses significant risk in multi-user WordPress environments or scenarios where attacker can compromise a Shop Manager account. Once exploited, an attacker gains the ability to execute arbitrary PHP code with the same privileges as the web server process, potentially leading to data theft, malware installation, or lateral movement within the network.

Root Cause

The root cause of this vulnerability is the unsafe use of PHP's eval() function combined with insufficient input validation. The evalConditions() function processes conditional logic rules for product addon fields, accepting an operator parameter that should contain legitimate comparison operators. However, the code fails to validate or sanitize this input before passing it to eval(), creating a classic code injection vector. The vulnerable code can be found in the conditional-logic.php file, specifically around lines 84 and 104, where user-controlled data flows directly into the dangerous eval() function.

Attack Vector

The attack leverages the network-accessible WordPress admin interface, targeting the addon form field rules functionality. An authenticated attacker with Shop Manager privileges can craft a malicious conditional logic rule containing PHP code within the operator parameter. When the server processes this rule through the evalConditions() function, the injected code is executed via eval(). The attack flow involves:

1. Authenticating to WordPress with Shop Manager or higher privileges
2. Accessing the product addon configuration interface
3. Creating or modifying a conditional logic rule with a malicious operator value
4. The server processes the rule, executing the injected PHP code

The vulnerability is accessible via the conditional logic operator parameter when saving addon form field rules. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis and the source code at line 104.

Detection Methods for CVE-2026-2296

Indicators of Compromise

• Suspicious modifications to conditional logic rules in the woo-custom-product-addons plugin configuration
• Unexpected PHP errors or execution traces in web server logs originating from conditional-logic.php
• Creation of new files, shells, or backdoors in the WordPress installation directory
• Unusual outbound network connections from the web server

Detection Strategies

• Monitor WordPress audit logs for changes to product addon conditional logic rules by Shop Manager accounts
• Implement file integrity monitoring on the WordPress installation to detect unauthorized file modifications
• Review web application firewall (WAF) logs for requests containing PHP code patterns in POST data to admin endpoints
• Enable PHP error logging and monitor for eval() execution warnings or errors from the plugin directory

Monitoring Recommendations

• Deploy real-time monitoring on the wp-content/plugins/woo-custom-product-addons/ directory for file changes
• Implement alerting for any new Shop Manager account creation or privilege escalation events
• Monitor for anomalous process spawning from PHP or web server processes
• Track database changes to the plugin's configuration tables for injection attempts

How to Mitigate CVE-2026-2296

Immediate Actions Required

• Update the Product Addons for WooCommerce plugin to a version newer than 3.1.0 immediately
• Review all Shop Manager and Administrator accounts for unauthorized access or suspicious activity
• Audit conditional logic rules in existing product addons for any malicious content
• Consider temporarily deactivating the plugin until the patch can be applied

Patch Information

The security fix has been applied in the plugin update following version 3.1.0. The patch addresses the unsafe use of eval() by implementing proper input validation and sanitization for the operator parameter. Details of the security changeset can be reviewed at the WordPress Plugin Changeset 3458823. Update through the WordPress plugin dashboard or manually download the patched version from the WordPress plugin repository.

Workarounds

• Restrict Shop Manager role capabilities to only trusted personnel until patching is complete
• Implement a Web Application Firewall (WAF) rule to block requests containing PHP code patterns in POST parameters to the plugin's admin endpoints
• Use WordPress security plugins to enforce strict input filtering on admin interfaces
• Consider implementing IP-based access restrictions for WordPress admin areas

# Configuration example - Restrict WordPress admin access by IP in Apache
# Add to .htaccess in wp-admin directory
<Files "admin.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>