CVE-2026-2996 Business logic in Advanced Product Fields (Product Addons) for WooCommerce
Unauthenticated attackers can bypass paid product addons and purchase items at base price due to improper input validation in the cart logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2996?
CVE-2026-2996 is a high-severity vulnerability in maartenbelmans Advanced Product Fields (Product Addons) for WooCommerce, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.
Weakness: CWE-20
Which versions are affected by CVE-2026-2996?
How do I fix CVE-2026-2996?
No fix has been published for CVE-2026-2996 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2996 being exploited?
There is no known exploitation of CVE-2026-2996 in the wild and no public exploit code.
Sources
Also known as GHSA-9gvr-wm3r-qgg4.