CVE-2026-119171
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.