CVE-2026-14270— Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ThemeComplete | Extra Checkout Options - addon for Extra Product Options plugin | ≤ 2.3.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14270
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings
Source: CVE Program / CVE List V5
Vulnerability Description
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Extra Checkout Options 任意文件上传漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Extra Checkout Options是WordPress基金会的一款结账选项扩展插件。 WordPress Extra Checkout Options 2.3.2及之前版本存在任意文件上传漏洞，该漏洞源于eco_save_settings()函数缺少授权和nonce验证，以及wc_eco_upload_file AJAX动作授权不足，可能导致认证攻击者上传PHP文件并实现远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ThemeComplete | Extra Checkout Options - addon for Extra Product Options plugin | 0 ~ 2.3.2 | - |
II. Public POCs for CVE-2026-14270
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14270
请登录查看更多情报信息。
Other References for CVE-2026-14270 (1)
IV. Related Vulnerabilities
Same weakness: CWE-434
- CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-s - CVE-2026-21662
FMS Employee Allows Upload of Unrestricted Files - CVE-2026-16236
Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Aut - CVE-2026-14483
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Una - CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is
V. Comments for CVE-2026-14270
No comments yet