Description

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via guest checkout without authentication because the malicious payload is embedded in a multipart Content-Disposition field name beginning with 'wpcpo-', which PHP's RFC1867 parser preserves byte-for-byte and stores into order item meta.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-10-03T07:16:49.530Z",
  "pubdate": "2026-10-03T07:16:49.530Z",
  "executiveSummary": "The WPC Product Options for WooCommerce plugin, in all versions up to and including 4.0.5, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from inadequate input sanitization and output escaping when processing multipart form data.\nThe vulnerability allows an unauthenticated remote attacker to inject malicious JavaScript payloads directly into order item meta via crafted multipart Content-Disposition headers.\nBecause the payload is stored persistently in the database, the script executes in the context of an administrator or shop manager's browser whenever they view the compromised order details within the WordPress dashboard.\nThis impact includes potential session hijacking, unauthorized administrative actions, or credential theft.\nThe attack vector is particularly dangerous because it does not require prior authentication, as the plugin processes these malicious parameters during the guest checkout flow.\nThe risk is critical for e-commerce environments where unauthenticated users can interact with product options, as it bypasses standard access control mechanisms to achieve persistent code execution on the server's management interface.",
  "technicalDetails": "The vulnerability resides in the way the WPC Product Options plugin handles input parameters prefixed with 'wpcpo-' during the WooCommerce checkout process.\nThe root cause is a failure to sanitize or validate the 'name' attribute of fields provided within a multipart/form-data request.\nWhen a user submits a checkout request, PHP's RFC1867 parser processes the multipart data. The plugin specifically targets parameters starting with the 'wpcpo-' prefix and saves these values into the WooCommerce order item meta.\nBecause the plugin treats the raw string provided in the Content-Disposition header's name field as trusted data, it fails to perform necessary output escaping before rendering this data in the administrative backend.\nAn attacker can exploit this by crafting a malicious HTTP request where a form field name is set to 'wpcpo-[payload]', where '[payload]' is a JavaScript block, such as <script>alert(document.cookie)</script>.\nSince the data is stored in the database as part of the order metadata, the XSS payload remains dormant until an authorized user, typically an administrator or order manager, accesses the 'Edit Order' screen in the WooCommerce administrative dashboard.\nWhen the browser renders the order metadata, the unescaped script is executed within the context of the user's session, leading to full Cross-Site Scripting exploitation.\nThe attack is highly effective as it requires no privileges; the guest checkout flow serves as the delivery mechanism for the payload. The PHP parser's preservation of the byte-for-byte input ensures the payload remains intact during transit into the database.\nThe post-exploitation impact is severe, potentially allowing an attacker to exfiltrate sensitive order data, hijack active administrator sessions, or perform unauthorized modifications to the WooCommerce store configuration if the victim has sufficient permissions."
}