What the vulnerability does
01Description
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).
Explanation of Vulnerability in Simple Terms
02Summary
Woocommerce Custom Product Addons Pro versions 5.4.1 and earlier contain a code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code on the site without user interaction. The vulnerability stems from improper handling of user input in a critical function. Attackers can gain full control of the WordPress installation, including access to the database and all site data.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site and take complete control of the WordPress installation.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site, database, and all customer data stored in WooCommerce.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 23, 2026
CVE published
April 8, 2026
Record updated
