What the vulnerability does
01Description
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 3.1.0. This is due to insufficient input validation of the 'operator' field in conditional logic rules within the evalConditions() function, which passes unsanitized user input directly to PHP's eval() function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server via the conditional logic 'operator' parameter when saving addon form field rules.
Explanation of Vulnerability in Simple Terms
02Summary
Product Addons for Woocommerce allows high-privilege users to inject and execute arbitrary code through custom field handling. An attacker with admin or equivalent access can run their own PHP code on the site, compromising data confidentiality, integrity, and availability. All versions up to 3.1.0 are affected.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full server access.
Potential impact on your site
04Site Impact
A compromised admin account can execute code to steal data, modify content, or disable the site.
Conditions required to exploit
05Prerequisites
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
