CVE-2026-4001

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).

• CWE-95

• https://acowebs.com/woo-custom-product-addons/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/70a2b6ff-defc-4722-9af9-3cae94e98632?source=cve

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40004There exists an openssl.cnf privilege escalation vulnerabili…7.8
• CVE-2026-40005Improper Limitation of a Pathname to a Restricted Directory …9.1
• CVE-2026-40006Memory Allocation with Excessive Size Value, Allocation of R…7.5
• CVE-2026-40007Uncontrolled Recursion, Uncontrolled Resource Consumption vu…7.5
• CVE-2026-40008Use of Externally-Controlled Input to Select Classes or Code…9.8
• CVE-2026-40009Improper Privilege Management, Improper Access Control vulne…6.5
• CVE-2026-40010Missing invocation of Servlet http web request method change…9.1
• CVE-2026-40011An attacker sending a large number of crafted DNS queries mi…3.7
• CVE-2026-40012ECS zero scoped answers are stored in the packet cache while…5.3
• CVE-2026-40016Attacker can upload a malicious Sieve script over ManageSiev…6.5
• CVE-2026-4002The Petje.af plugin for WordPress is vulnerable to Cross-Sit…4.3
• CVE-2026-40020Attacker can use the IMAP SETACL command to inject the anyon…4.3