CVE-2026-19089

Name of the Vulnerable Software and Affected Versions Product Input Fields for WooCommerce versions prior to 2.0.2

Description An issue exists where the plugin fails to validate uploaded file types when the accepted-types setting is left empty. This configuration, which is advertised in the documentation as a way to accept all files, allows unauthenticated attackers to upload arbitrary files. This can lead to remote code execution on servers that do not enforce directory access rules.

Recommendations Update Product Input Fields for WooCommerce to version 2.0.2 or later. Avoid leaving the accepted-types setting empty to prevent the upload of arbitrary files.