CVE-2026-4001 Details
Description
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).
A remote code execution vulnerability exists in the Woocommerce Custom Product Addons Pro plugin for WordPress, affecting all versions prior to 5.4.1. The issue arises in the process_custom_formula() function within includes/process/price.php, where user-submitted values are inadequately sanitized before being evaluated by PHP's eval() function. Although the sanitize_values() method removes HTML tags, it fails to escape single quotes or block PHP code injection. This vulnerability allows unauthenticated attackers to execute arbitrary code on the server by sending a manipulated value to a WCPA text field that uses a custom pricing formula.
Users are advised to update the Woocommerce Custom Product Addons Pro plugin to version 5.4.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 24, 2026CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://acowebs.com/woo-custom-product-addons/ | [email protected] | ProductVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/70a2b6ff-defc-4722-9af9-3cae94e98632?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Acowebs Woocommerce Custom Product Addons Pro | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | New CVE Received | [email protected] |