CVE-2026-14270: 
WordPress vulnerability analysis and mitigation

CVE-2026-14270 is an Arbitrary File Upload vulnerability in the Extra Checkout Options plugin (an addon for Extra Product Options & Add-Ons for WooCommerce) for WordPress, affecting all versions up to and including 2.3.2. The flaw allows authenticated attackers with Subscriber-level access or above to upload PHP files and achieve remote code execution. It was discovered and reported by Wordfence, with the CVE published on July 29, 2026. A partial fix was introduced in version 2.3.2, but the vulnerability is not fully remediated in that release. The CVSS v3.1 base score is 8.8 (High), assigned by Wordfence (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and stems from two compounding weaknesses in the plugin (GitHub Advisory). First, the eco_save_settings() function lacks proper authorization checks and nonce validation, allowing any low-privileged authenticated user (Subscriber-level or above) to modify the tc_eco_custom_file_types upload allowlist setting to permit PHP file uploads. Second, the wc_eco_upload_file AJAX action has insufficient authorization controls, and its upload nonce is exposed on publicly accessible cart and checkout pages. An attacker can chain these two weaknesses: first modifying the allowlist to permit PHP, then using the exposed frontend nonce to upload a malicious PHP file via the AJAX action, resulting in remote code execution (Wordfence).

Successful exploitation grants an attacker full remote code execution on the WordPress server, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive data (database credentials, user data, configuration files), modify or delete site content, install backdoors or web shells for persistent access, and potentially pivot to other systems on the same hosting environment. Because only Subscriber-level access is required — a role that can be obtained by self-registration on many WordPress sites — the effective attack surface is broad (GitHub Advisory, Wordfence).

1. Obtain Subscriber-level access: Register a standard user account on the target WordPress site (if open registration is enabled) or use compromised credentials to authenticate as a Subscriber or higher-privileged user.
2. Modify the file upload allowlist: Send an authenticated POST request to the WordPress admin AJAX endpoint targeting the eco_save_settings() function, modifying the tc_eco_custom_file_types setting to add php to the allowed file types. This succeeds due to missing authorization and nonce validation.
3. Retrieve the frontend upload nonce: Visit the site's cart or checkout page as an authenticated user and extract the wc_eco_upload_file nonce value exposed in the page source or JavaScript variables.
4. Upload a PHP web shell: Submit a crafted AJAX request to the wc_eco_upload_file action, including the retrieved nonce and a malicious PHP file (e.g., a simple web shell such as <?php system($_GET['cmd']); ?>) as the file payload.
5. Achieve remote code execution: Identify the uploaded file's path on the server (typically within the WordPress uploads directory) and send HTTP requests to it with arbitrary OS commands to execute code in the context of the web server user (Wordfence, GitHub Advisory).

• Network: Unusual POST requests to wp-admin/admin-ajax.php with action=eco_save_settings or action=wc_eco_upload_file from low-privileged user sessions; HTTP requests to .php files in the WordPress uploads directory (/wp-content/uploads/) that return 200 OK responses.
• File System: Unexpected .php files in the WordPress uploads directory (e.g., /wp-content/uploads/); newly created files with web shell signatures (e.g., system(), exec(), passthru(), base64_decode() function calls).
• Logs: WordPress or web server access logs showing POST requests to admin-ajax.php with eco_save_settings or wc_eco_upload_file actions from subscriber-level accounts; subsequent GET/POST requests to PHP files in the uploads directory.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or network scanning tools.

Site administrators should upgrade the Extra Checkout Options plugin to a version beyond 2.3.2, as version 2.3.2 contains only a partial fix and the vulnerability remains exploitable in that release (Wordfence). As interim mitigations, administrators should restrict file upload functionality to administrator roles only, implement server-side rules (e.g., via .htaccess or web server configuration) to deny execution of PHP files in the uploads directory, and review access controls for the eco_save_settings() function. Disabling the plugin entirely until a fully patched version is available is advisable for high-risk environments.