CVE-2026-19089

CVE-2026-19089 is an unauthenticated arbitrary file upload flaw (CWE-434) in the Product Input Fields for WooCommerce WordPress plugin. When the plugin's accepted file-types setting is left empty — a state its own documentation describes as accepting all file types — the plugin performs no validation of uploaded file types, so anyone can submit files of any kind, including executable scripts, through the product input fields without an account. On servers where the upload directory's access rules are not honoured (i.e., uploaded files can be executed rather than just served), an attacker achieves remote code execution on the web server. All sites running the plugin in versions before 2.0.2 are affected, with critical severity (CVSS 9.8) because no authentication or user interaction is required. A public proof-of-concept is available, but current signals (EPSS ~0.5%, not in CISA KEV) indicate no confirmed in-the-wild exploitation yet.

What to do: Update Product Input Fields for WooCommerce to version 2.0.2 or later. As interim mitigation, configure the accepted-types setting to explicitly allow only safe file types (e.g., images) and/or disable PHP execution in the upload directory at the web-server level. Administrators should also check the uploads directory for unexpected PHP files and review logs for unauthenticated upload activity.