CVE-2026-19089 — CRITICAL (9.8)

Vulnerability Description

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-434

References

https://wpscan.com/vulnerability/c5728a31-de92-40df-ab19-aec4db84ba21/

FAQ

What is CVE-2026-19089?

CVE-2026-19089 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as ac...

How severe is CVE-2026-19089?

CVE-2026-19089 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-19089?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.