CVE-2026-2296
Published: 18 February 2026
Summary
CVE-2026-2296 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-2296 is a code injection vulnerability affecting the Product Addons for WooCommerce – Product Options with Custom Fields plugin for WordPress, in all versions up to and including 3.1.0. The issue stems from insufficient input validation of the 'operator' field in conditional logic rules processed by the evalConditions() function, which passes unsanitized user input directly to PHP's eval() function. This flaw is classified under CWE-94 (Improper Control of Generation of Code) with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Shop Manager-level access or higher can exploit this vulnerability by injecting arbitrary PHP code through the conditional logic 'operator' parameter when saving addon form field rules. Successful exploitation allows remote code execution on the server, potentially leading to full compromise of the WordPress site, including high confidentiality, integrity, and availability impacts.
References provided include source code locations in the plugin's conditional-logic.php file (lines 84 and 104 in tags/3.0.19 and trunk versions), highlighting the eval() usage, along with a specific changeset (r3458823) in the WordPress plugin trac repository, which likely documents the patch addressing the input validation deficiency.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8083
Vulnerability details
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 3.1.0. This is due to insufficient input validation of the 'operator' field in conditional…
more
logic rules within the evalConditions() function, which passes unsanitized user input directly to PHP's eval() function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server via the conditional logic 'operator' parameter when saving addon form field rules.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via unauthenticated input to eval() in public-facing WordPress plugin enables T1190 exploitation and T1505.003 web shell deployment.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the 'operator' field before it reaches eval() in evalConditions().
Limits the number of accounts that receive Shop Manager privileges capable of saving conditional-logic rules.
Enforces access restrictions on configuration changes to the addon rules that trigger the vulnerable code path.