CVE-2026-19728

Name of the Vulnerable Software and Affected Versions Extra Product Options Builder for WooCommerce versions prior to 1.2.176

Description An issue exists where the plugin fails to verify if a requester is authorized to access a customer-uploaded file before serving it. This allows unauthenticated users to retrieve files if they obtain the stored file name. The exploitation of this issue depends on the web server configuration; it affects servers that honor deny-all rules in upload directories, such as Apache. On servers where such rules are ignored, like default nginx setups, files are already accessible via their direct URL, and the getpublicfileupload endpoint provides no additional exposure.

Recommendations Update Extra Product Options Builder for WooCommerce to version 1.2.176 or later.