CVE-2026-2996 Overview
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress contains an improper input validation flaw affecting all versions up to and including 1.6.21. The issue resides in the validate_cart_data function and allows unauthenticated attackers to bypass required paid addons during checkout. Attackers can complete purchases at the base product price while receiving products configured with additional paid options. The vulnerability was partially patched in version 1.6.19 and further addressed in subsequent releases. This flaw affects store revenue integrity rather than confidentiality or availability.
Critical Impact
Unauthenticated attackers can bypass paid addon validation and purchase products at a fraction of the intended total, resulting in direct financial loss for merchants.
Affected Products
- Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress
- All versions up to and including 1.6.21
- Partial patch introduced in 1.6.19
Discovery Timeline
- 2026-08-22 - CVE-2026-2996 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-2996
Vulnerability Analysis
The flaw is a business logic and input validation defect [CWE-20] in the validate_cart_data function of the Advanced Product Fields plugin. The function fails to properly verify that submitted cart data reflects the required paid addon selections associated with a product. As a result, an attacker can craft cart submissions that omit or manipulate addon fields while still adding the underlying product. WooCommerce then processes the order at the base product price, and the store fulfills the order as if the paid addons were included. The issue is exploitable over the network without authentication or user interaction, making it accessible to any visitor of an affected storefront.
Root Cause
The root cause is insufficient server-side validation of cart contents against the product configuration. The validate_cart_data logic does not enforce that all mandatory paid addons appear in the submitted cart payload, allowing attackers to strip required fields or supply values that bypass price recalculation.
Attack Vector
An unauthenticated remote attacker submits a manipulated add-to-cart or checkout request that omits paid addon parameters or supplies values the validator accepts without applying the addon surcharge. Checkout proceeds at the base price and the order is completed normally. See the WordPress Plugin Product Controller source and the Wordfence Vulnerability Report for technical detail on the affected code path.
Detection Methods for CVE-2026-2996
Indicators of Compromise
- Completed WooCommerce orders where the total price is lower than the configured minimum price for the product including required addons.
- Order line items missing expected paid addon metadata that should accompany the purchased product.
- Repeated add-to-cart or checkout requests from the same IP submitting inconsistent addon field data.
Detection Strategies
- Compare order totals against the sum of base price plus mandatory addon prices for each product SKU and alert on mismatches.
- Monitor HTTP POST parameters submitted to WooCommerce cart and checkout endpoints for absent or malformed addon fields.
- Review web server access logs for automated patterns targeting /?wc-ajax=add_to_cart and checkout endpoints.
Monitoring Recommendations
- Enable WooCommerce order audit logging and alert on anomalously low-value orders for products with paid addons.
- Track the plugin version installed across WordPress environments and flag hosts running 1.6.21 or earlier.
- Reconcile fulfillment records against expected order totals to catch under-priced sales after the fact.
How to Mitigate CVE-2026-2996
Immediate Actions Required
- Update the Advanced Product Fields (Product Addons) for WooCommerce plugin to the latest available version beyond 1.6.21.
- Audit recent orders for products with mandatory paid addons to identify potentially fraudulent low-price purchases.
- Temporarily disable the plugin on storefronts that cannot be patched immediately if paid addons drive material revenue.
Patch Information
The issue was partially patched in version 1.6.19 and further addressed in subsequent plugin releases tracked in WordPress Changeset #3477476 and WordPress Changeset #3483410. Administrators should upgrade to the newest release available in the WordPress plugin repository to ensure the validate_cart_data fix is applied.
Workarounds
- Manually review and hold orders for products that require paid addons until the plugin is updated.
- Deploy a web application firewall rule that inspects cart submissions and rejects requests missing required addon fields for known SKUs.
- Restrict checkout to authenticated customers where feasible to increase accountability during the mitigation window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
