CVE-2026-116866

Name of the Vulnerable Software and Affected Versions Extra Fees Plugin for WooCommerce versions prior to 4.4.1

Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker to manipulate the application logic. Authenticated users with contributor-level access or higher can inject a PHP Object. While no native POP chain (a sequence of gadgets used to achieve code execution) exists within the plugin, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update the plugin to a version newer than 4.4.0.