CVE-2026-39499: WooCommerce Product Addons PHP Injection

CVE-2026-39499 Overview

CVE-2026-39499 is a PHP Object Injection vulnerability in the Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 1.6.19. Exploitation requires Shop manager privileges, so the attacker must already hold a high-privilege role on the target site. Successful exploitation allows the attacker to inject crafted serialized PHP objects, which can trigger property-oriented programming (POP) chains during deserialization. The issue is classified under CWE-502: Deserialization of Untrusted Data.

Critical Impact
An authenticated Shop manager can inject malicious PHP objects to achieve code execution, file manipulation, or data exfiltration on the WordPress host.

Affected Products

Advanced Product Fields (Product Addons) for WooCommerce plugin versions <= 1.6.19
WordPress sites running WooCommerce with the affected plugin installed
Any environment exposing Shop manager-level access to untrusted users

Discovery Timeline

2026-06-15 - CVE-2026-39499 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2026-39499

Vulnerability Analysis

The plugin passes attacker-controlled input into a PHP deserialization routine without validating its origin or structure. When PHP encounters a serialized object, it instantiates the corresponding class and invokes magic methods such as __wakeup, __destruct, or __toString. If a usable POP gadget chain exists within WordPress core, WooCommerce, or other installed plugins, the deserialization can be leveraged to execute arbitrary code, write files, or query the database.

The attacker must authenticate as a Shop manager, which limits broad opportunistic exploitation but elevates the risk in multi-administrator commerce environments. Once executed, the injected object operates with the privileges of the PHP-FPM or web server process, yielding full read/write access to the WooCommerce database and wp-content directory.

Root Cause

The root cause is unsafe handling of serialized data through unserialize() or an equivalent sink reachable from a Shop manager endpoint. Input validation does not constrain object types, and there is no allow-list of acceptable classes passed via the allowed_classes option. As a result, any serialized payload supplied by an authenticated Shop manager is reconstructed into live PHP objects.

Attack Vector

The attack vector is network-based and requires a valid Shop manager session. The attacker submits a crafted serialized payload to a vulnerable plugin endpoint, typically through an administrative form, AJAX action, or REST route exposed by the addon framework. The payload references a gadget class whose magic method triggers the destructive behavior. No user interaction beyond the attacker's own request is required, and the scope remains within the compromised WordPress installation.

For a full technical breakdown, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-39499

Indicators of Compromise

HTTP requests from Shop manager accounts containing serialized PHP markers such as O: or a: followed by class names in POST bodies or query strings
Unexpected creation or modification of files within wp-content/uploads/ or plugin directories
New or modified PHP files owned by the web server user outside of normal deployment windows
Outbound network connections from the PHP process to unrecognized hosts

Detection Strategies

Inspect web server and WordPress audit logs for Shop manager activity targeting the advanced-product-fields-for-woocommerce plugin endpoints
Deploy a WordPress security plugin or Web Application Firewall (WAF) rule that flags serialized PHP objects in request parameters
Correlate authenticated administrative requests with subsequent file system or process anomalies on the host

Monitoring Recommendations

Enable WordPress activity logging to track role changes, plugin uploads, and Shop manager logins
Monitor PHP error logs for __wakeup, __destruct, or class instantiation errors that indicate failed deserialization attempts
Alert on any spawn of sh, bash, curl, or wget from the PHP-FPM process tree

How to Mitigate CVE-2026-39499

Immediate Actions Required

Update the Advanced Product Fields (Product Addons) for WooCommerce plugin to a version newer than 1.6.19 as soon as the vendor publishes a fix
Audit all accounts holding the Shop manager role and remove or downgrade unnecessary privileges
Enforce strong, unique passwords and multi-factor authentication on every administrative WordPress account

Patch Information

Review the Patchstack Vulnerability Report for the latest fixed version and upgrade guidance. Apply the vendor patch through the WordPress plugin update mechanism, then verify the installed version on each site.

Workarounds

Restrict access to /wp-admin/ by source IP using web server rules until the plugin is patched
Deploy a WAF rule that blocks request bodies containing serialized PHP object signatures such as O:\d+:"
Temporarily disable the affected plugin if Shop manager accounts cannot be fully trusted or audited

bash

# Example nginx rule to block serialized PHP object payloads in POST bodies
location ~ \.php$ {
    if ($request_method = POST) {
        set $block_payload 0;
        if ($request_body ~* "O:[0-9]+:\"") {
            set $block_payload 1;
        }
        if ($block_payload = 1) {
            return 403;
        }
    }
}