WordPress plugin
PPOM – Product Addons & Custom Fields for WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High1
- Medium9
- Low0
All PPOM – Product Addons & Custom Fields for WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.1 | Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter ≤34.0.10Update to 34.0.11 | CVE-2026-104801 | |
| High7.5 | Unauthenticated SQL Injection ≤33.0.15Update to 33.0.16 | CVE-2025-11691 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤33.0.15Update to 33.0.16 | CVE-2025-11391 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via ppom_upload_file ≤32.0.18Update to 32.0.19 | CVE-2024-3962 | |
| Critical9.8 | Arbitrary File Upload ≤1.1Update to 2.0 | — |
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
≤34.0.10Update to 34.0.11
- High7.5Unauthenticated SQL Injection
≤33.0.15Update to 33.0.16
- Critical9.8Unauthenticated Arbitrary File Upload
≤33.0.15Update to 33.0.16
- Critical9.8Unauthenticated Arbitrary File Upload via ppom_upload_file
≤32.0.18Update to 32.0.19
- Critical9.8Arbitrary File Upload
≤1.1Update to 2.0
PPOM – Product Addons & Custom Fields for WooCommerce: common questions
Does PPOM – Product Addons & Custom Fields for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in PPOM – Product Addons & Custom Fields for WooCommerce: 4 critical, 1 high, 9 medium. None are known to affect version null.
How do I check which version of PPOM – Product Addons & Custom Fields for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent PPOM – Product Addons & Custom Fields for WooCommerce vulnerability?
CVE-2026-104801, published Oct 9, 2026: PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter. Severity: Critical (CVSS 9.1).
Is any PPOM – Product Addons & Custom Fields for WooCommerce vulnerability listed in CISA KEV?
No. None of the known PPOM – Product Addons & Custom Fields for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.