CVE-2026-4001

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-400109.1Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack iCVE-2026-400113.7An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalCVE-2026-400125.3ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;CVE-2026-400134.3An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write CVE-2026-400146.5An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the sCVE-2026-400154.3An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermitCVE-2026-400166.5Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 CVE-2026-400176.5An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makeCVE-2026-400187.4None None None No publicly available exploits are known.CVE-2026-400195.9An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop cCVE-2026-40024.3The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to missCVE-2026-400204.3Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This c