CVE-2026-4001 WooCommerce Custom Product Addons Pro RCE

CVE-2026-4001 is a critical-severity vulnerability. AttackerView checks WordPress sites for it with a live exploit check.

Deterministic critical WordPress Added 7mo ago cve-verified-cve-2026-4001

Is my site vulnerable to CVE-2026-4001?

Detects WooCommerce Custom Product Addons Pro plugin before version 5.4.2, where the custom pricing formula feature uses PHP eval() on user-submitted values without proper sanitization. Unauthenticated attackers can inject arbitrary PHP code through add-to-cart requests, achieving remote code execution.

Related WordPress exploits

CVE-2026-119977 Unauthenticated Remote Code Execution Through the Core Upgrade Staging Directory
CVE-2026-63030 Unauthenticated REST Batch Route Confusion
CVE-2026-87902 Unauthenticated Page-Template Path Traversal (LFI to RCE)
CVE-2026-6518 Admin File Upload to RCE via CMP Coming Soon & Maintenance
CVE-2026-5617 Subscriber-to-Admin Takeover via Cookie Forgery
CVE-2026-1555 WebStack Theme Unauthenticated Arbitrary File Upload
CVE-2026-0740 Unauthenticated Arbitrary File Upload via Ninja Forms File Uploads
CVE-2026-2942 Unauthenticated Arbitrary File Upload via ProSolution WP Client
CVE-2026-5032 Security Token Exposure via User-Agent Bypass
CVE-2026-0686 Webmention Plugin Unauthenticated SSRF
CVE-2026-5130 Unauthenticated Admin Takeover via Cookie Forgery
CVE-2026-4021 Admin Account Takeover via MySQL Integer Coercion
CVE-2026-4020 Unauthenticated System Report Exposure via REST API
CVE-2026-32525 Authenticated Remote Code Execution via SSR Validation Callback
CVE-2026-4373 Unauthenticated Arbitrary File Read via Media Field Path Traversal
CVE-2026-3300 Unauthenticated Remote Code Execution via Form Calculation
CVE-2026-3090 Stored XSS via Post SMTP Email Logs
CVE-2026-3658 Unauthenticated SQL Injection via REST API Fields Parameter
CVE-2026-7567 Unauthenticated Admin Takeover via Temporary Login Token Type Confusion
CVE-2026-1238 Unauthenticated Stored XSS via Fingerprint Tracking
CVE-2026-4257 Remote Code Execution via Twig Template Injection
CVE-2026-3334 SQL Injection in CMS Commander Backup Restore
CVE-2026-2579 Unauthenticated SQL Injection via Product Search
CVE-2026-23550 Unauthenticated Admin Access via Authentication Bypass
CVE-2026-1463 Local File Inclusion via Gallery Template Parameter
CVE-2026-3533 Subscriber File Upload via Broken Access Control
CVE-2026-2991 Patient Account Takeover via KiviCare Social Login Bypass
CVE-2026-2941 Linksy Search and Replace Subscriber-to-Admin Privilege Escalation
CVE-2025-12707 Library Management System SQL Injection
CVE-2025-2005 Front End Users Unauthenticated File Upload
CVE-2026-2448 SiteOrigin Page Builder Local File Inclusion
CVE-2026-2413 Ally Plugin SQL Injection via URL Path
CVE-2026-3585 The Events Calendar Authenticated LFI via CSV Import
CVE-2026-1357 WPvivid File Upload via Crypto Fail-Open
CVE-2026-3891 Pix for WooCommerce Unauthenticated File Upload
CVE-2026-2628 SSO Plugin Authentication Bypass
CVE-2026-2631 Datalogics Plugin Privilege Escalation
CVE-2026-3584 Kali Forms Remote Code Execution
CVE-2026-1648 Performance Monitor Unauthenticated SSRF
CVE-2026-4484 Privilege Escalation via LMS Instructor API
CVE-2026-4347 Arbitrary File Move via Form Plugin Path Traversal
CVE-2026-4662 Unauthenticated SQL Injection via JetEngine Listing AJAX Handler
CVE-2026-4283 Unauthenticated Account Destruction via GDPR Plugin Missing Authorization
CVE-2026-4314 Subscriber-to-Admin Privilege Escalation via Menu Editor Plugin
CVE-2026-2580 Unauthenticated SQL Injection via WP Maps Orderby Parameter
CVE-2025-15484 WooCommerce Store Takeover via Permission Bypass
CVE-2026-3535 Unauthenticated Arbitrary File Upload via DSGVO Google Web Fonts GDPR Plugin
CVE-2026-3296 PHP Object Injection via Everest Forms Unserialize
CVE-2026-3614 Subscriber-to-Admin Privilege Escalation via AcyMailing AJAX Router
CVE-2026-77770 miniOrange 2FA Unauthenticated Arbitrary Option Deletion

Is your app exploitable through CVE-2026-4001?

Scan your domain free