CVE-2026-19728 Missing authorization in Extra Product Options Builder for WooCommerce
Unauthenticated attackers can retrieve customer-uploaded files if they know the filename, provided the web server honors directory deny rules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19728?
CVE-2026-19728 is a high-severity missing authorization vulnerability in Unknown Extra Product Options Builder for WooCommerce, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it.
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
Weakness: CWE-862
Which versions are affected by CVE-2026-19728?
How do I fix CVE-2026-19728?
No fix has been published for CVE-2026-19728 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-19728 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19728 exists.
Sources
Also known as GHSA-8j7v-p66v-g3f9.