Woocommerce Custom Product Addons Pro <= 5.4.1 — Unauthenticated Remote Code Execution via Custom Pricing Formula

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Woocommerce Custom Product Addons Pro.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 5.4.2, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Woocommerce Custom Product Addons Pro to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Ren Voza.

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. Mar 23, 2026

   CVE published

   Severity critical, CVSS 9.8

2. Nov 13, 2026

   Record last updated