Skip to content
Threat Feed
Subscribe

Product

Extra Checkout Options (Addon for Extra Product Options & Add-Ons for WooCommerce) Plugin <= 2.3.2

1 brief RSS
critical advisory

Critical Arbitrary File Upload in WordPress Extra Checkout Options Plugin Leads to RCE (CVE-2026-14270)

A critical arbitrary file upload vulnerability (CVE-2026-14270) in the Extra Checkout Options plugin for WordPress, affecting versions up to and including 2.3.2, allows low-privileged authenticated users to modify upload allowlists and upload malicious PHP files via an AJAX action, ultimately achieving remote code execution on the server.

Extra Checkout Options wordpress plugin arbitrary-file-upload rce web-application
2r 4t 1c