CVE-2026-39499

Name of the Vulnerable Software and Affected Versions Advanced Product Fields (Product Addons) for WooCommerce versions prior to 1.6.20

Description The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject a PHP Object. This issue affects authenticated users with shop manager-level access or higher. While no POP chain (a sequence of gadgets used to achieve code execution) is inherent to the software, the presence of one in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 1.6.19.