CVE-2026-14270

Name of the Vulnerable Software and Affected Versions Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) versions prior to 2.3.3

Description An arbitrary file upload issue exists due to missing authorization and nonce validation in the eco save settings() function. This allows authenticated users with Subscriber-level access or higher to modify the tc eco custom file types upload allowlist setting. When combined with insufficient authorization on the wc eco upload file AJAX action, attackers can enable PHP uploads and upload a PHP file using the frontend upload nonce found on cart and checkout pages, leading to remote code execution.

Recommendations Update to a version newer than 2.3.2.