CVE-2026-14270 in Extra Checkout Options Plugin
Summary
by MITRE • 07/29/2026
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The Extra Checkout Options plugin for WordPress represents a critical security vulnerability that affects versions up to and including 2.3.2, creating a pathway for unauthorized file manipulation through improper access controls. This vulnerability stems from insufficient authorization checks within the eco_save_settings() function, which fails to validate user permissions before allowing modifications to core upload configurations. The flaw specifically targets the tc_eco_custom_file_types setting that controls allowed file types for uploads, enabling attackers to expand the permitted file extensions beyond their intended scope. The vulnerability operates under CWE-285, which addresses insufficient authorization issues in software systems, and aligns with ATT&CK technique T1059.007 for command and script injection through PHP execution.
The technical exploitation of this vulnerability begins with a low-privileged authenticated user leveraging their subscriber-level access to modify the upload allowlist settings. This unauthorized modification enables the attacker to include php file extensions in the allowed upload types, effectively bypassing the intended security restrictions. The vulnerability is further compounded by insufficient authorization controls on the wc_eco_upload_file AJAX endpoint, which exposes a frontend nonce that attackers can utilize for legitimate-looking file uploads. This dual weakness creates a perfect storm where authenticated users can manipulate both the server-side configuration and client-side upload mechanisms simultaneously.
The operational impact of this vulnerability extends beyond simple file upload capabilities to encompass full remote code execution potential within the targeted WordPress environment. Attackers can leverage this privilege escalation to upload malicious PHP files that execute arbitrary code on the server, potentially leading to complete system compromise. The attack surface is particularly concerning because it operates through legitimate checkout and cart pages where frontend nonces are exposed, making the exploitation process more隐蔽 and harder to detect through standard security monitoring. This vulnerability directly enables ATT&CK technique T1505.003 for web shell deployment and T1078.004 for account manipulation, allowing attackers to establish persistent access points within the compromised environment.
Mitigation strategies must address both the immediate configuration flaws and broader architectural weaknesses that enabled this vulnerability. Immediate remediation involves upgrading to version 2.3.2 or later where partial fixes have been implemented, though organizations should verify that these updates fully resolve the authorization gaps. System administrators should implement strict file type validation at multiple layers, including server-side checks that cannot be bypassed through frontend manipulation. Network-level monitoring should be enhanced to detect unusual upload patterns and PHP file extensions being added to allowlists. Security configurations must enforce proper nonce validation for all AJAX endpoints and ensure that user permissions are strictly enforced before any configuration changes can be applied. Organizations should also consider implementing web application firewalls with rules specifically targeting unauthorized file upload attempts and monitor for suspicious activity in checkout-related pages where the exposed nonces exist.
The vulnerability demonstrates how seemingly minor authorization gaps can create catastrophic security implications when combined with other configuration weaknesses. This particular flaw represents a classic case of insufficient input validation and privilege escalation that aligns with CWE-352, covering cross-site request forgery issues that have been exploited for privilege elevation. The incident highlights the critical importance of implementing defense-in-depth strategies where multiple layers of security controls work together to prevent exploitation attempts. Organizations should implement regular security audits focused on plugin configurations and ensure that all AJAX endpoints properly validate user permissions and nonces before executing potentially dangerous operations. The vulnerability serves as a reminder that even low-privileged users can cause significant damage when proper access control mechanisms are missing from core application functions.