CVE-2026-19802

Name of the Vulnerable Software and Affected Versions Checkout Custom Fields Builder for WooCommerce versions prior to 1.1.6

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can exploit this to install and activate an arbitrary plugin hosted by the attacker, leading to remote code execution on the server. When WooCommerce is inactive, the required nonce (a unique token used to prevent cross-site request forgery) is emitted inline on all admin pages accessible to subscribers, allowing them to harvest it and trigger the exploit without additional privileges.

Recommendations Update Checkout Custom Fields Builder for WooCommerce to version 1.1.6 or later.