CVE-2026-1929 in Advanced Woo Labels Plugin
Summary
by MITRE • 02/25/2026
The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.37. This is due to the use of `call_user_func_array()` with user-controlled callback and parameters in the `get_select_option_values()` AJAX handler without an allowlist of permitted callbacks or a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP functions and operating system commands on the server via the 'callback' parameter.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/09/2026
The Advanced Woo Labels plugin for WordPress presents a critical remote code execution vulnerability that affects all versions up to and including 237. This flaw resides within the `get_select_option_values()` AJAX handler which improperly processes user-supplied data through the `call_user_func_array()` function. The vulnerability stems from the absence of proper input validation and authorization checks, creating a dangerous attack vector that can be exploited by authenticated users with contributor-level privileges or higher. The lack of callback whitelisting combined with insufficient capability verification allows attackers to manipulate the system's execution flow by injecting malicious function names through the callback parameter.
The technical implementation of this vulnerability exploits the inherent dangers of dynamic function invocation in php applications. When `call_user_func_array()` receives user-controllable input without proper sanitization or validation, it creates an environment where arbitrary code execution becomes possible. The AJAX handler specifically processes parameters that should be restricted to predefined legitimate functions, but instead accepts any callable function name passed through the callback parameter. This design flaw violates fundamental security principles of least privilege and input validation, allowing attackers to escalate their privileges from contributor status to full system control through carefully crafted malicious requests.
The operational impact of this vulnerability extends beyond simple code execution to encompass complete system compromise for authenticated users with contributor-level access or higher. Attackers can leverage this weakness to execute arbitrary operating system commands, potentially leading to data theft, service disruption, or further network infiltration. The vulnerability affects WordPress installations that utilize the Advanced Woo Labels plugin, making it particularly dangerous in e-commerce environments where such plugins are commonly deployed. The attack surface is widened by the fact that contributors typically have sufficient permissions to modify product information and labels, making the exploitation less detectable within normal administrative activities.
Mitigation strategies for this vulnerability require immediate implementation of several security measures including updating to the latest plugin version which should contain proper callback whitelisting and capability checks. Administrators must ensure that all WordPress plugins undergo regular security updates and vulnerability assessments before deployment in production environments. The fix should implement strict input validation using a predefined allowlist of permitted callbacks combined with robust authentication checks to verify user privileges before executing any dynamic function calls. Additionally, network segmentation and monitoring solutions should be deployed to detect anomalous AJAX request patterns that might indicate exploitation attempts. This vulnerability aligns with CWE-470 and CWE-74 standards regarding unsafe use of dynamic code execution functions and improper input validation. The attack pattern follows ATT&CK techniques for privilege escalation and command execution through web application interfaces, emphasizing the need for comprehensive application security controls including input sanitization, output encoding, and principle of least privilege enforcement across all user roles and permissions within WordPress installations.