CVE-2026-81789 HIGH

CVE-2026-81789: WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

Vendor Studio Wombat
Product Advanced Product Fields Extended for WooCommerce
Weakness CWE-22 · Path traversal
Published September 10, 2026
Last update September 11, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.

Key dates

02Disclosure timeline

September 10, 2026 CVE published
September 11, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-57696 WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability CVE-2026-59555 WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CVE-2026-28146 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability