CVE-2026-2996 in Advanced Product Fields Plugin
Summary
by MITRE • 08/22/2026
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Advanced Product Fields plugin for WooCommerce represents a significant security risk due to an improper input validation flaw identified within its core logic. This vulnerability affects all versions up to and including 1.6.21, stemming from a specific defect in the validate_cart_data function. The fundamental issue lies in how the application processes cart data during the checkout process, allowing unauthenticated attackers to manipulate transaction parameters without proper verification against server-side rules.
From a technical perspective, the flaw enables an attacker to bypass required paid addons associated with WooCommerce products. By exploiting this logic error, malicious actors can submit requests that omit or alter addon pricing information while still completing the purchase flow. Consequently, the system processes these transactions at the base product price rather than the intended total which includes mandatory add-ons. This mechanism effectively allows for the theft of digital goods or services by paying only a fraction of the actual cost, undermining the revenue model and integrity of e-commerce operations relying on this plugin.
The operational impact is severe for businesses utilizing WooCommerce with paid addons enabled. Financial losses accumulate as customers exploit this loophole to acquire products at significantly reduced prices. Furthermore, such exploitation can lead to inventory discrepancies if physical goods are involved or service overuse in digital contexts. The vulnerability was partially patched in version 1.6.19, indicating that earlier versions remain fully exploitable and require immediate attention from administrators who have not yet updated their installations.
This type of vulnerability aligns with CWE-20 Improper Input Validation, where the software fails to correctly validate input data before processing it. Additionally, the exploitation technique relates to ATT&CK T1196 Exploitation for Financial Gain, as attackers leverage this flaw specifically to obtain goods or services without paying the full price. To mitigate this risk, organizations must ensure they are running a version of the Advanced Product Fields plugin that is newer than 1.6.21. Regular updates and patch management procedures should be enforced across all WordPress environments hosting WooCommerce stores to prevent such financial exploitation attacks from succeeding.