CVE-2026-39499: PHP Object Injection in Advanced Product Fields for WooCommerce ≤1.6.19

Technical summary

CVE-2026-39499 is a PHP object injection vulnerability (CWE-502: Deserialization of Untrusted Data) in Advanced Product Fields for WooCommerce up to version 1.6.19. The plugin fails to properly validate or sanitize serialized PHP objects before unserializing them, allowing an authenticated shop manager to craft and inject malicious object chains that achieve remote code execution. The attack vector is network-based with no user interaction required beyond the attacker's own authenticated action, and it bypasses standard access controls by leveraging the built-in capabilities of the shop manager role.

Business impact

Successful exploitation allows a malicious or compromised shop manager to execute arbitrary PHP code within the WooCommerce environment, leading to full compromise of the e-commerce installation. An attacker could exfiltrate customer data, payment information, or intellectual property; modify product listings and pricing; inject malware into the storefront; or pivot laterally to underlying systems. For multi-tenant or SaaS deployments, this could affect multiple merchants. The high CVSS score (7.2) reflects the severity: while authentication is required, the impact spans confidentiality, integrity, and availability.

Affected systems

Advanced Product Fields (Product Addons) plugin for WooCommerce versions 1.6.19 and earlier are vulnerable. The attack requires the WooCommerce platform and PHP environment to be in use. Any site running an affected version with shop manager accounts is at risk, particularly if those accounts are shared, delegated to contractors, or otherwise exposed to compromise.

Exploitability

Exploitation requires valid shop manager or administrator credentials and network access to the WordPress admin panel or vulnerable API endpoints. The attack complexity is low—no special conditions, race conditions, or user interaction are needed once the attacker is authenticated. There are no public exploits documented in CISA KEV as of the analysis date, but the vulnerability is straightforward to exploit once the injection point is identified. Internal threats or compromised credentials pose the highest immediate risk.

Remediation

Update Advanced Product Fields (Product Addons) to a patched version released after 1.6.19. Verify the exact version number in the vendor advisory or plugin repository. As an interim control, restrict shop manager role assignments to trusted personnel only, enforce strong authentication (including multi-factor authentication), monitor admin panel access logs, and consider disabling the plugin if it is not actively used. Review user accounts with shop manager privileges and audit their recent activity.

Patch guidance

Obtain the latest version of Advanced Product Fields (Product Addons) directly from the WordPress plugin repository or the vendor's official website. Verify that the version number is higher than 1.6.19 before deployment. Test the update in a staging environment to confirm compatibility with your WooCommerce and PHP versions. Deploy during a maintenance window and verify functionality of product addon features post-update. If auto-updates are enabled, ensure they are configured to apply security patches promptly.

Detection guidance

Monitor PHP error logs and application logs for unserialize() warnings or exceptions related to the product addons plugin. Search web server access logs for unusual POST requests to admin endpoints or REST API endpoints used by the plugin. Audit WordPress user activity logs (via security plugins such as Wordfence or Sucuri) for shop manager account logins from unexpected locations or times, or rapid API calls suggestive of exploitation. Check file integrity of the plugin directory for unauthorized modifications. Network-based detection should focus on anomalous outbound connections from the web server immediately following admin panel access.

Why prioritize this

This vulnerability merits urgent patching because it combines high severity (CVSS 7.2), full confidentiality/integrity/availability impact, and a common WordPress environment. Although it requires authentication, the shop manager role is often delegated and may be compromised through credential theft, phishing, or insider threats. E-commerce sites storing payment or customer data face regulatory and reputational risk. Delaying the patch extends the window in which a compromised account could lead to data breach or operational disruption.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) is driven by: (1) Network attack vector—the vulnerability is reachable via the network; (2) Low attack complexity—no special conditions required beyond valid credentials; (3) High privilege requirement—shop manager role is needed, which is a control that mitigates unauthenticated attacks; (4) High impact across confidentiality, integrity, and availability—unserialize() allows arbitrary code execution. The score does not account for threat landscape or likelihood of credential compromise, which would further elevate risk in practice.

Frequently asked questions