CVE-2026-2996

Name of the Vulnerable Software and Affected Versions Advanced Product Fields (Product Addons) for WooCommerce versions prior to 1.6.22

Description Improper Input Validation occurs due to a logic flaw in the validate cart data() function. This allows unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, resulting in the acquisition of products for a fraction of the intended total.

Recommendations Update Advanced Product Fields (Product Addons) for WooCommerce to version 1.6.22 or later.