meComplete Extra Checkout Options Plugin up to 2.3.2 on WordPress File Upload eco_save_settings tc_eco_custom_file_types improper authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in meComplete Extra Checkout Options Plugin up to 2.3.2. Impacted is the function eco_save_settings of the component File Upload. Performing a manipulation of the argument tc_eco_custom_file_types results in improper authorization. This vulnerability is reported as CVE-2026-14270. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in meComplete Extra Checkout Options Plugin up to 2.3.2. This affects the function eco_save_settings of the component File Upload. The manipulation of the argument tc_eco_custom_file_types with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.

It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2026-14270 since 06/30/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/29/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• meComplete

Name

• Extra Checkout Options Plugin

Version

• 2.3.0
• 2.3.1
• 2.3.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion