Description

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T06:16:52.673Z",
  "pubdate": "2026-08-16T06:16:52.673Z",
  "executiveSummary": "The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 suffers from an insecure direct object reference and missing authorization vulnerability affecting customer-uploaded files. This security flaw allows unauthenticated attackers to retrieve sensitive user-uploaded files without proper access control verification.\nThe vulnerability impacts the Extra Product Options Builder for WooCommerce WordPress plugin in versions prior to 1.2.176. The risk profile depends heavily on the underlying web server architecture. While the plugin attempts to mitigate exposure by writing a deny-all rule into its upload directories, this control is only effective on web servers that honor such directives, such as Apache. On servers that ignore these rules, such as default Nginx configurations, files may already be accessible via direct URLs, though the affected endpoint specifically exposes the flaw where access controls fail.\nAn unauthenticated attacker with knowledge of a file's stored name can exploit this vulnerability to download arbitrary customer-uploaded files. The exploitation requirement is minimal, needing only the predictable or obtained stored filename of the targeted asset. The primary impact is unauthorized information disclosure, potentially compromising private customer data uploaded during the WooCommerce product configuration process.",
  "technicalDetails": "The vulnerability stems from missing authorization and access control validation within the file retrieval functionality of the Extra Product Options Builder for WooCommerce WordPress plugin. Specifically, the affected component fails to verify whether the incoming HTTP requester possesses the appropriate entitlements or ownership permissions to access a specific customer-uploaded file prior to serving the content.\nThe root cause is the absence of session validation, ownership checks, or cryptographic token verification when processing file download requests. When a file is requested via its stored name, the application processes the retrieval without enforcing boundary checks to ensure the requester is authorized to view the asset.\nThe attack flow proceeds as follows. First, an unauthenticated attacker obtains the stored filename of a customer-uploaded file, which may be achieved through information leakage, predictable naming conventions, or enumeration. Second, the attacker issues a direct HTTP request to the vulnerable endpoint or direct URL associated with the file storage mechanism. Third, because the application lacks entitlement verification, the server processes the request and streams the requested file back to the client. On Apache web servers, although the plugin writes a deny-all rule into upload directories, the vulnerable endpoint bypasses or fails to properly enforce application-layer authorization. Conversely, on default Nginx deployments where directory-level access control rules are ignored, the files are persistently exposed at their direct URLs, rendering the vulnerability similarly accessible.\nThe affected product is the Extra Product Options Builder for WooCommerce WordPress plugin for all versions prior to 1.2.176. The vulnerability requires no authentication or special privileges, operating entirely over network exposure via HTTP/HTTPS protocols. The post-exploitation impact is limited to unauthorized data access and information disclosure of customer uploads, but this can lead to secondary privacy violations and the exposure of personally identifiable information."
}