CVE-2026-2296: 
WordPress vulnerability analysis and mitigation

CVE-2026-2296 is a Code Injection vulnerability in the Product Addons for WooCommerce – Product Options with Custom Fields WordPress plugin (by Acowebs), affecting all versions up to and including 3.1.0. The flaw allows authenticated attackers with Shop Manager-level access or higher to inject and execute arbitrary PHP code on the server. It was published on February 18, 2026, with a CVSS v3.1 base score of 7.2 (High) (Feedly, Wordfence).

The root cause is improper control of code generation (CWE-94): the plugin's evalConditions() function passes the operator field from conditional logic rules directly to PHP's eval() function without adequate input sanitization or validation. An attacker with Shop Manager privileges can craft a malicious operator parameter value when saving addon form field rules, causing the server to execute arbitrary PHP code. No special configuration is required beyond having a Shop Manager (or higher) account on the target WordPress/WooCommerce installation (Feedly).

Successful exploitation grants the attacker full remote code execution on the web server, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive data (e.g., database credentials, customer PII), modify or delete site content, install backdoors or web shells, and potentially pivot to other systems on the same network. The scope is limited to the affected server, but the severity of a full server compromise makes this a critical operational risk for affected WooCommerce stores (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.056%, indicating a currently low probability of exploitation in the near term. The vulnerability requires authenticated access at the Shop Manager level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog based on available information (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running WooCommerce with the "Product Addons for WooCommerce" plugin (version ≤ 3.1.0) via plugin enumeration tools (e.g., WPScan) or by checking /wp-content/plugins/woo-product-addons/ paths.
2. Obtain credentials: Acquire Shop Manager (or higher) credentials through phishing, credential stuffing, or purchasing access via underground markets.
3. Authenticate: Log in to the WordPress admin panel (/wp-admin/) using the obtained credentials.
4. Navigate to addon configuration: Access the WooCommerce Product Addons settings and open or create an addon form field that supports conditional logic rules.
5. Inject malicious payload: When saving a conditional logic rule, intercept the HTTP request (e.g., via Burp Suite) and modify the operator parameter to include a PHP payload, such as system('id') or a reverse shell command.
6. Trigger execution: Submit the modified request; the server's evalConditions() function passes the unsanitized operator value to eval(), executing the injected PHP code.
7. Achieve objective: Use the resulting code execution to establish persistence (e.g., drop a web shell), exfiltrate data, or move laterally within the server environment (Feedly).

• Logs: WordPress/WooCommerce admin action logs showing Shop Manager accounts saving addon form field rules with unusual or encoded operator values; PHP error logs referencing eval() execution errors or unexpected output from evalConditions().
• File System: Newly created or modified PHP files in the WordPress uploads directory or plugin directories (potential web shells); unexpected .php files with obfuscated content.
• Network: Outbound connections from the web server process (e.g., apache2, nginx, php-fpm) to unknown external IP addresses, particularly on non-standard ports (indicative of reverse shell activity).
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, sh, curl, wget, python) following admin panel activity.

Update the Product Addons for WooCommerce – Product Options with Custom Fields plugin to version 3.1.1 or later, which addresses the insufficient input validation in the evalConditions() function. If an immediate update is not possible, restrict Shop Manager account access to trusted personnel only and monitor admin activity logs for anomalous behavior. Additionally, consider using a WordPress security plugin (e.g., Wordfence) to detect and block suspicious admin-side requests (Wordfence, Feedly).

Wordfence included CVE-2026-2296 in its weekly WordPress vulnerability report for February 16–22, 2026, flagging it as a notable code injection issue for WooCommerce store operators (Wordfence). Red Hat also tracked the CVE in its security advisory database (Red Hat). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregation was identified.