The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it.
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Additional Product Fields For Woocommerce Plugin | — | Update additional-product-fields-for-woocommerce plugin to version 1.2.176, or a newer patched version | Oct 30, 2026 | Aug 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub