CVE-2026-14270

The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.

• CWE-434

• https://codecanyon.net/item/extra-checkout-options-addon-for-extra-product-options/20439659
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a929efaf-80a1-45c1-9426-6c5b45a66530?source=cve

Published

Jul 29, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1426The Advanced AJAX Product Filters plugin for WordPress is vu…8.8
• CVE-2026-14261A vulnerability in the Xerte Online Tools allows for authent…9.1
• CVE-2026-14262The Simple JWT Login – Allows you to use JWT on REST endpoin…8.8
• CVE-2026-14265Deserialization of untrusted data in the RemoteQueryCachePlu…8.8
• CVE-2026-142667-Zip XZ Decompression Heap-based Buffer Overflow Remote Cod…7.8
• CVE-2026-1427Single Sign-On Portal System developed by WellChoose has a O…8.8
• CVE-2026-14278Rejected reason: After further coordination, CVE was determi…
• CVE-2026-1428Single Sign-On Portal System developed by WellChoose has a O…8.8
• CVE-2026-14282The GoDAM – Organize WordPress Media Library & File Manager …9.8
• CVE-2026-14286Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-14289The FacturaONE para WooCommerce con VeriFactu WordPress plug…9
• CVE-2026-1429Single Sign-On Portal System developed by WellChoose has a R…5.4