Critical Arbitrary File Upload in WordPress Extra Checkout Options Plugin Leads to RCE (CVE-2026-14270)

A significant security vulnerability, CVE-2026-14270, has been identified in the Extra Checkout Options plugin for WordPress, affecting all versions up to and including 2.3.2. This flaw enables low-privileged authenticated users, specifically those with Subscriber-level access or higher, to achieve remote code execution (RCE) on affected WordPress installations. The vulnerability stems from a combination of missing authorization and inadequate nonce validation within the eco_save_settings() function, which allows attackers to modify the tc_eco_custom_file_types upload allowlist to include PHP files. This, coupled with insufficient authorization on the wc_eco_upload_file AJAX action, permits the upload of malicious PHP files using frontend nonces typically found on cart and checkout pages. Exploitation of this vulnerability grants attackers full control over the compromised WordPress site and potentially the underlying server.

Attack Chain

1. An authenticated attacker with Subscriber-level privileges or higher logs into the vulnerable WordPress site.
2. The attacker sends a crafted HTTP POST request to wp-admin/admin-ajax.php with the action=eco_save_settings parameter, exploiting missing authorization and nonce validation to modify the tc_eco_custom_file_types allowlist to include PHP file extensions.
3. The attacker navigates to a cart or checkout page on the WordPress site to obtain a valid frontend upload nonce.
4. Using the acquired nonce, the attacker sends another crafted HTTP POST request to wp-admin/admin-ajax.php with action=wc_eco_upload_file, uploading a malicious PHP file (e.g., a web shell).
5. Due to insufficient authorization on the wc_eco_upload_file AJAX action, the plugin processes and saves the malicious PHP file to an accessible directory on the WordPress server.
6. The attacker then makes a direct HTTP request to the URL of the newly uploaded PHP file.
7. The web server executes the malicious PHP file, granting the attacker remote code execution capabilities on the underlying system.

Impact

Successful exploitation of CVE-2026-14270 grants attackers remote code execution on the compromised WordPress server. This can lead to severe consequences, including complete takeover of the website, defacement, theft of sensitive data (such as customer information or payment details), installation of backdoors for persistent access, or using the compromised server as a platform for launching further attacks (e.g., botnet participation, phishing campaigns). The impact extends beyond the immediate website to potentially affecting customer trust and leading to significant financial and reputational damages for the affected organization.

Recommendation

• Immediately update the Extra Checkout Options plugin to a version patched against CVE-2026-14270.
• Deploy the provided Sigma rules to your webserver logs or WAF to detect attempts to exploit CVE-2026-14270.
• Monitor web server access logs for HTTP POST requests to /wp-admin/admin-ajax.php with action=eco_save_settings and request_body containing "php" within tc_eco_custom_file_types.
• Monitor web server access logs for HTTP POST requests to /wp-admin/admin-ajax.php with action=wc_eco_upload_file and request_body indicating a PHP file upload (e.g., containing <?php or .php in filenames).
• Review file system integrity monitoring logs for unexpected PHP file creations in WordPress upload directories.