Description

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-22T14:16:32.807Z",
  "pubdate": "2026-08-22T14:16:32.807Z",
  "executiveSummary": "The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to an Improper Input Validation vulnerability affecting all versions up to, and including, 1.6.21, with an incomplete partial patch introduced in version 1.6.19.\nThe core vulnerability stems from a logic flaw residing within the plugin's cart data validation mechanisms, specifically the 'validate_cart_data' function.\nThis security defect enables unauthenticated threat actors to entirely bypass mandatory paid product add-ons during the checkout process.\nConsequently, attackers can successfully complete purchases by paying exclusively the base product price, effectively acquiring enhanced products at a fraction of their intended total cost and resulting in direct financial loss for merchants.\nThe exploitation vector requires network exposure to the vulnerable WordPress storefront and can be executed entirely without authentication or specific user privileges.\nThe risk implications are severe for e-commerce integrity, as automated scripts or malicious buyers can manipulate cart validation logic to systematically commit financial fraud and unauthorized product acquisition.\nMitigation requires upgrading the affected Advanced Product Fields (Product Addons) for WooCommerce plugin beyond version 1.6.21 to fully remediate the logic flaw in the 'validate_cart_data' function.",
  "technicalDetails": "The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress contains an Improper Input Validation vulnerability in all versions up to, and including, 1.6.21.\nThe root cause of the vulnerability is a logic flaw located within the 'validate_cart_data' function, which is responsible for verifying that required and paid add-on data submitted by users is properly processed and enforced before items are added to the shopping cart and processed through checkout.\nThe vulnerability is exposed over the network via standard HTTP/HTTPS protocols utilized by the WordPress e-commerce interface.\nAuthentication and privilege requirements are absent, meaning unauthenticated external attackers can interact with the vulnerable endpoint.\nThe attack flow begins when an unauthenticated attacker selects a WooCommerce product configured with mandatory paid add-ons managed by the vulnerable plugin.\nDuring the cart addition and data submission phase, the attacker crafts a malicious request or manipulates client-side parameters intended to interact with the 'validate_cart_data' function.\nDue to the logic flaw, the 'validate_cart_data' function fails to properly validate, enforce, or sanitize the incoming cart data payload against the required paid add-ons.\nAs a result of this improper input validation, the validation checks are bypassed entirely, allowing the cart session to register the item without attaching the mandatory paid add-ons or charging their corresponding fees.\nThe payment gateway subsequently processes the transaction solely for the base product price.\nPost-exploitation impact involves financial fraud, unauthorized acquisition of enhanced goods, and inventory discrepancies, as merchants fulfill orders containing paid add-ons that were never financially settled.\nA partial patch was previously attempted in version 1.6.19, but it failed to fully resolve the logic flaw, leaving versions up to and including 1.6.21 vulnerable to exploitation."
}