CVE-2026-4001: 
WordPress vulnerability analysis and mitigation

CVE-2026-4001 is a Remote Code Execution (RCE) vulnerability in the WooCommerce Custom Product Addons Pro plugin for WordPress, affecting all versions up to and including 5.4.1. The flaw resides in the process_custom_formula() function within includes/process/price.php, where user-supplied input is passed unsanitized to PHP's eval() function. It was published on March 24, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Wordfence).

The root cause is CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code — 'Eval Injection'). The plugin's sanitize_values() method strips HTML tags but fails to escape single quotes or block PHP code injection, allowing arbitrary PHP to be passed directly into eval(). An unauthenticated attacker can exploit this by submitting a crafted value to any WCPA text field that has been configured with a custom pricing formula (pricingType: "custom" with {this.value}), requiring no authentication or special privileges. A technical advisory is available from Yazoul (Yazoul Advisory, Wordfence).

Successful exploitation grants an unauthenticated remote attacker full code execution on the underlying web server, resulting in high confidentiality, integrity, and availability impact. Attackers can read sensitive data (database credentials, customer PII, payment information), modify or destroy site content, install backdoors or web shells, and pivot to other systems on the same network. The scope of compromise extends to the entire WordPress installation and potentially the hosting environment (Red Hat CVE, Wordfence).

As of the time of reporting, no public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.183%, reflecting a currently low but non-trivial probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WooCommerce Custom Product Addons Pro plugin (version ≤ 5.4.1) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/woo-custom-product-addons-pro/).
2. Identify vulnerable product fields: Browse the target WooCommerce store and locate product pages that use WCPA text fields configured with a custom pricing formula (pricingType: "custom" with {this.value}).
3. Craft malicious payload: Prepare a PHP code injection payload exploiting the lack of single-quote escaping in sanitize_values(), for example: '); system('id'); // or a reverse shell payload.
4. Submit crafted input: Submit the malicious value via the WCPA text field on the product page (e.g., via a standard HTTP POST request to the WooCommerce add-to-cart endpoint), triggering process_custom_formula() → eval() with the injected code.
5. Achieve code execution: The server evaluates the injected PHP, returning command output or establishing a reverse shell, granting full control of the web server process (Yazoul Advisory, Wordfence).

• Network: Unusual outbound connections from the web server process to external IPs (potential reverse shell); HTTP POST requests to WooCommerce add-to-cart or AJAX endpoints containing PHP function names (e.g., system, exec, passthru, base64_decode) in field values.
• Logs: Web server access logs showing POST requests to /wp-admin/admin-ajax.php or product pages with anomalous, encoded, or PHP-like content in body parameters; PHP error logs referencing eval() or process_custom_formula() in includes/process/price.php.
• File System: Newly created PHP files in wp-content/uploads/, wp-content/plugins/, or other writable directories (potential web shells); unexpected modifications to core WordPress or plugin files.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker (e.g., bash, sh, curl, wget, python) with no corresponding legitimate user activity.

No official patch has been confirmed as available for versions beyond 5.4.1 at the time of reporting. Site administrators should immediately audit all installations of WooCommerce Custom Product Addons Pro and consider disabling or removing the plugin until a patched version is released. As a temporary mitigation, deploy a Web Application Firewall (WAF) rule to block requests containing PHP code patterns in WCPA field inputs. Monitor server logs for exploitation indicators and contact the plugin vendor (Acowebs) for patch availability. The Wordfence weekly report (March 23–29, 2026) includes this vulnerability in its advisory roundup (Wordfence Weekly Report, Wordfence).

Wordfence disclosed and assigned the CVE, including it in their weekly WordPress vulnerability report for the week of March 23–29, 2026 (Wordfence Weekly Report). Social media activity was observed on Bluesky and Mastodon shortly after disclosure, with security community accounts sharing the CVE details (Bluesky). Red Hat also tracked the vulnerability in their security advisory database (Red Hat CVE). Overall community reaction reflects concern given the unauthenticated, network-exploitable nature of the flaw and the absence of a confirmed patch.